What is LDAP Security?

LDAP security focuses on protecting directory services from injection attacks, unauthorized access, and data exposure through proper configuration and access controls.

What is LDAP injection?

LDAP injection occurs when user-supplied input is incorporated into LDAP queries without proper sanitization. Attackers craft malicious filter expressions using special characters like parentheses, asterisks, and backslashes to modify query logic. This can bypass authentication, enumerate directory objects, extract sensitive attributes, or modify directory entries depending on the application permissions.

How can LDAP communications be secured?

LDAP communications should use LDAPS (LDAP over TLS on port 636) or StartTLS for encryption. Enforce certificate validation to prevent man-in-the-middle attacks, disable anonymous binds, require strong authentication mechanisms like SASL, implement channel binding to prevent relay attacks, and configure TLS with modern cipher suites while disabling SSLv3 and early TLS versions.

What LDAP access controls should be implemented?

Implement granular ACLs restricting read and write access to directory attributes based on user roles. Protect sensitive attributes like passwords, security questions, and personal data with restricted access. Use proxy authorization for application service accounts, enforce bind authentication requirements, limit search scope and result sizes, and audit access control changes regularly.

How do attackers enumerate LDAP directories?

Attackers enumerate LDAP directories through anonymous binds if enabled, NULL base searches to discover naming contexts, wildcard searches across object classes, LDAP referral following to discover federated directories, and exploitation of verbose error messages revealing directory structure. Tools like ldapsearch, windapsearch, and BloodHound automate Active Directory enumeration through LDAP queries.

What are LDAP passback attacks?

LDAP passback attacks target devices like printers and appliances that authenticate against LDAP servers. Attackers modify the device LDAP configuration to point to an attacker-controlled server, then trigger an authentication attempt. The device sends stored credentials to the rogue server in plaintext or easily crackable form, exposing service account passwords used for directory binds.

How should LDAP be hardened in Active Directory?

Harden LDAP in Active Directory by enforcing LDAP signing and channel binding, requiring LDAPS for all client connections, disabling LDAP simple binds over unencrypted connections, implementing LDAP query rate limiting, monitoring for reconnaissance queries, restricting the LAPS password attribute access, and configuring domain controller audit policies to log LDAP bind operations.

What tools test LDAP security?

Security testing tools include ldapsearch for manual enumeration, Nmap LDAP scripts for service discovery, custom LDAP injection fuzzing tools, BloodHound and SharpHound for Active Directory relationship mapping, Responder for LDAP relay attacks, and specialized scanners that check for anonymous access, weak ACLs, and plaintext authentication. Manual testing with crafted LDAP filters remains essential.

How does LDAP relate to modern identity management?

LDAP remains foundational in enterprise identity management despite the rise of cloud identity providers. Modern architectures often use LDAP as a backend for SAML and OIDC identity providers, creating hybrid environments. Security challenges include synchronization vulnerabilities, legacy protocol support, and the expanded attack surface of LDAP-to-cloud federation configurations requiring consistent security policies.