LDAP is a protocol, not a piece of software. It defines a wire format and a set of operations that a client (your application) and a server (the directory) agree to speak. Understanding those operations is enough to understand almost everything else in this guide.
An LDAP client opens a TCP connection to a directory server, usually on port 389 (plain) or 636 (encrypted, LDAPS — see LDAP vs LDAPS). Everything after that is a sequence of requests and responses over that one connection.
Common LDAP servers include:
- Active Directory (Microsoft) — almost always the directory behind enterprise Windows environments.
- OpenLDAP — a widely used open-source implementation.
- 389 Directory Server, ApacheDS, and various cloud identity providers that expose LDAP interop.
Every one of these speaks the same core protocol, which is why the same client code (and the same ldapjs library) can talk to any of them.
LDAP defines a small number of operations. You'll use most of these directly:
| Operation | Purpose |
|---|---|
| Bind | Authenticate as a user (or bind anonymously). Covered in Bind and authentication. |
| Search | Look up one or more entries matching a filter. Covered in Searching. |
| Compare | Check whether an attribute on an entry has a specific value, without reading the whole entry. |
| Add | Create a new entry. |
| Modify | Change attributes on an existing entry. |
| Delete | Remove an entry. |
| Unbind | Close the connection. |
Note
Most read-heavy applications only ever use Bind and Search. Add/Modify/Delete are typically reserved for administrative tools.
Here's what a login check against LDAP usually looks like:
- The client opens a connection to the directory server.
- The client binds — either anonymously, as a service account, or (for a login check) as the end user with the password they typed in.
- If the bind succeeds, the credentials were correct.
- The client searches for the user's entry to read attributes like group membership or email.
- The client unbinds and closes the connection.
This is the exact pattern used in Authentication with ldapjs.
A single LDAP connection can have multiple outstanding requests in flight — the client doesn't have to wait for one operation to finish before starting the next. In practice, most application code (including ldapjs) hides this behind a simple async/await or callback API, but it's part of why LDAP connections can be reused efficiently across many concurrent lookups.
Now that you know the operations, the next step is understanding what's actually being searched and bound against: the directory structure itself.