LDAP (Lightweight Directory Access Protocol) is how most organizations store and look up information about people, groups, computers, and other resources. If your company uses Active Directory, Okta LDAP interop, OpenLDAP, or almost any enterprise identity system, LDAP is very likely involved somewhere.
This guide teaches LDAP from first principles, then shows you how to use it from Node.js with ldapjs, and how it behaves specifically in Active Directory.
Note
You don't need any prior directory services experience. We start with what a directory even is.
LDAP shows up almost anywhere an application needs to answer one of these questions:
- Who is this user, and what's their email or display name?
- What groups does this user belong to?
- Is this username and password combination valid?
- Which computers, printers, or service accounts exist in this organization?
Instead of every application maintaining its own list of users, they all read from (and sometimes write to) one shared directory over LDAP.
It's tempting to think of LDAP as "a weird SQL database," but a directory is optimized for a different job:
- Reads dominate. Directories are read constantly (every login, every permission check) and written to rarely (someone joins, changes teams, or leaves).
- Data is hierarchical. Entries live in a tree, not tables and rows. A user's position in the tree often encodes information, like which organizational unit or region they belong to.
- Lookups are by name. Every entry has a globally unique name, called a distinguished name, which we'll cover in Distinguished names.
- dc=com
- dc=example
- ou=Users
- cn=Jane Doe
- ou=Groups
- cn=Engineering
- ou=Users
- dc=example
That's a small directory tree: a root domain, an organizational unit for people, another for groups, and two entries inside them. Every entry in LDAP fits into a tree shaped like this one.
This guide is organized as a learning path, roughly in this order:
- Getting Started (you are here) — directories, DNs, entries, binding, searching, filters, and TLS.
- Node.js — connecting, binding, searching, and authenticating using ldapjs.
- Active Directory — the specifics of Microsoft's LDAP implementation.
- Security — encrypting connections and avoiding LDAP injection.
Along the way, interactive tools let you experiment with real LDAP syntax without standing up a directory server.
LDAP Filter Builder
Try the LDAP Filter Builder.
Ready to start? Continue to How LDAP works.