RFC 4511 — LDAP v3

Q: What does the Introduction section cover in RFC 4511 — LDAP v3?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4511 — LDAP v3. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Protocol Operations section cover in RFC 4511 — LDAP v3?

The Protocol Operations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4511 — LDAP v3. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Directory Information Tree section cover in RFC 4511 — LDAP v3?

The Directory Information Tree section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4511 — LDAP v3. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Authentication & Bind section cover in RFC 4511 — LDAP v3?

The Authentication & Bind section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4511 — LDAP v3. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Access Control section cover in RFC 4511 — LDAP v3?

The Access Control section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 4511 — LDAP v3. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

RFC 4511 — LDAP v3

Lightweight Directory Access Protocol (LDAP) — directory access protocol for reading and modifying distributed directory information services over IP networks, critical for identity management and access control.

Standards Track June 2006 ISO 27001

1. Introduction

▶

LDAP v3 is the standard protocol for accessing directory services — hierarchical databases optimized for read-heavy identity lookups. It is the backbone of enterprise identity management, providing centralized user authentication, authorization, and attribute storage.

ISO 27001 Relevance: A.5.15 (Access Control) — centralized identity store. A.5.16 (Identity Management) — lifecycle management of digital identities. A.8.2 (Privileged Access) — group/role-based access via directory attributes. A.8.5 (Secure Authentication) — Bind operations for credential verification.

2. Protocol Operations

▶

Core LDAP operations:

Operation	Purpose	ISO Control
Bind	Authenticate client to server	A.8.5
Search	Query directory entries	A.5.15
Add/Delete/Modify	Manage directory entries	A.5.16
ModifyDN	Move/rename entries	A.5.16
Compare	Test attribute values	A.8.5
Extended	Protocol extensions (StartTLS, etc.)	A.8.24

3. Directory Information Tree

▶

LDAP organizes entries in a hierarchical tree (DIT). Each entry has a Distinguished Name (DN) and contains attributes defined by schema:

  dc=blacklabs,dc=team
  ├── ou=People
  │   ├── uid=admin (objectClass: inetOrgPerson)
  │   ├── uid=operator (objectClass: inetOrgPerson)
  │   └── uid=auditor (objectClass: inetOrgPerson)
  ├── ou=Groups
  │   ├── cn=admins (member: uid=admin,...)
  │   └── cn=readonly (member: uid=auditor,...)
  └── ou=Services
      ├── cn=nrf (objectClass: applicationProcess)
      └── cn=smf (objectClass: applicationProcess)

4. Authentication & Bind

▶

LDAP supports multiple authentication mechanisms:

Simple Bind: DN + password (MUST use with TLS per A.8.24)
SASL Bind: Pluggable mechanisms — GSSAPI (Kerberos), EXTERNAL (TLS client cert), DIGEST-MD5
Anonymous Bind: No credentials — SHOULD be disabled per A.8.5

Security: Simple Bind transmits passwords in cleartext. MUST use StartTLS (RFC 4513) or LDAPS (port 636) to encrypt the connection. ISO A.8.24 requires encryption of credentials in transit.

5. Access Control

▶

While LDAP v3 does not define a standard access control model, implementations provide:

ACIs/ACLs: Per-entry and per-attribute access rules
Bind DN authorization: Operations are authorized based on the authenticated identity
Operational attributes: createTimestamp, modifyTimestamp, creatorsName for audit trails (A.8.15)

6. Security Considerations

▶

Transport security: MUST use TLS (StartTLS or LDAPS) — RFC 4513
Password policy: Enforce complexity, expiry, lockout via ppolicy overlay
Injection: Sanitize search filter inputs to prevent LDAP injection attacks
Replication security: Encrypt and authenticate replication traffic between directory replicas
Audit logging: Log all Bind, Add, Modify, Delete operations for A.8.15 compliance