Please enable JavaScript.
Coggle requires JavaScript to display documents.
LDAP (Lightweight Directory Access Protocol) - Coggle Diagram
LDAP (Lightweight Directory Access Protocol)
What is LDAP
Protocol for centralized identity management
Stores users groups devices policies and organizational information
Provides authentication and directory lookup
Eliminates local user management on individual servers
Uses hierarchical directory structure
Default Port
389 LDAP
636 LDAPS Secure SSL TLS
Common Implementations
OpenLDAP
Microsoft Active Directory
Red Hat Directory Server
389 Directory Server
Apache Directory Server
Why Enterprises Use LDAP
Centralized authentication
Single source of user accounts
Easy user provisioning and deprovisioning
Centralized group management
Supports thousands of Linux servers
Integrates with Active Directory
Supports Single Sign-On
Improves security auditing
Reduces administrative effort
Enterprise Architecture
Users
Employees
Contractors
Administrators
Client Systems
Linux Servers
Ubuntu
RHEL
Debian
Workstations
LDAP Clients
SSSD
NSS
PAM
LDAP Servers
OpenLDAP
Active Directory
389 Directory Server
Supporting Services
DNS
NTP
Kerberos
Certificate Authority
Applications
SSH
Apache
Nginx
Samba
GitLab
Jenkins
VPN
Kubernetes
LDAP Directory Structure
Root Domain
dc=company
dc=com
Organizational Units
ou=People
ou=Groups
ou=Servers
ou=Departments
ou=Applications
User Objects
uid=bilal
uid=john
Group Objects
cn=linuxadmins
cn=developers
cn=soc
Device Objects
Servers
Printers
Network Devices
LDAP Naming
DN Distinguished Name
Complete unique path
uid=bilal,ou=People,dc=company,dc=com
RDN Relative Distinguished Name
uid=bilal
Base DN
dc=company,dc=com
OU Organizational Unit
ou=People
CN Common Name
cn=linuxadmins
UID
Username
DC
Domain Component
LDAP Authentication Flow
User logs in
PAM receives login request
PAM calls SSSD
SSSD queries LDAP server
LDAP validates credentials
LDAP returns user information
NSS resolves user details
Linux creates session
User gets shell access
Enterprise Login Flow
User enters SSH credentials
SSH calls PAM
PAM contacts SSSD
SSSD queries LDAP
LDAP verifies password
NSS retrieves UID GID Home Shell
Access granted
Home directory mounted if configured
LDAP Components
LDAP Server
Stores directory database
LDAP Client
Linux machine requesting authentication
SSSD
Caches users
Authentication
Authorization
NSS
Resolves user information
PAM
Handles authentication
TLS
Encrypts LDAP traffic
Kerberos
Password authentication
Single Sign-On
Linux Authentication Stack
Login
PAM
SSSD
NSS
LDAP
User Database
LDAP Security
Never use anonymous bind in production
Use LDAPS
Use TLS certificates
Strong password policy
Disable insecure protocols
Least privilege
RBAC
Audit logging
Account lockout
Password expiration
MFA if supported
LDAP Ports
389
LDAP
636
LDAPS
Enterprise User Management
Create users centrally
Disable users centrally
Password reset centrally
Group assignment
Department assignment
Access control
Policy enforcement
Enterprise Group Management
Linux Admins
DevOps
Developers
Database Team
SOC Team
HR
Finance
Network Team
Security Team
Enterprise Access Control
LDAP Groups
LinuxAdmins
SudoUsers
DockerUsers
Developers
Sudo Access
LDAP group mapped to sudo
SSH Access
LDAP group controls login
Application Access
GitLab
Jenkins
VPN
Kubernetes
Enterprise Benefits
Centralized management
Scalability
Consistent authentication
Reduced administration
Faster onboarding
Faster offboarding
Improved compliance
Easier auditing
OpenLDAP Server Installation Ubuntu
Install Packages
sudo apt update
sudo apt install slapd ldap-utils
Configure
sudo dpkg-reconfigure slapd
Verify
systemctl status slapd
Check Port
ss -tulnp
Test
ldapsearch
LDAP Client Installation Ubuntu
Install Packages
sudo apt install sssd libnss-sss libpam-sss ldap-utils
Configure SSSD
Configuration File
/etc/sssd/sssd.conf
Secure Permissions
chmod 600
Restart
systemctl restart sssd
Configure NSS
File
/etc/nsswitch.conf
Enable
passwd
group
shadow
Configure PAM
Command
pam-auth-update
Enable LDAP Authentication
Useful LDAP Commands
ldapsearch
Search directory
ldapadd
Add object
ldapmodify
Modify object
ldapdelete
Delete object
ldapwhoami
Verify authentication
ldapcompare
Compare attributes
slapcat
Backup LDAP database
slapadd
Restore LDAP database
slaptest
Validate configuration
Common ldapsearch Examples
ldapsearch -x
ldapsearch -x -LLL
ldapsearch -H ldap://server
ldapsearch -D cn=admin,dc=company,dc=com
ldapsearch -W
ldapsearch -b dc=company,dc=com
ldapsearch uid=bilal
Linux Verification Commands
getent passwd
getent group
id username
groups username
passwd username
ssh
username@server
systemctl status sssd
journalctl -u sssd
ldapwhoami
SSSD Commands
systemctl restart sssd
systemctl status sssd
sss_cache -E
sssctl domain-list
sssctl user-checks username
sssctl config-check
Troubleshooting
Check DNS
Check NTP
Check LDAP connectivity
Check Firewall
Check TLS Certificates
Check SSSD logs
Check PAM configuration
Check NSS configuration
Verify Base DN
Verify Bind DN
Verify User Object
Verify Group Membership
Enterprise High Availability
Multiple LDAP servers
Replication
Load Balancer
Automatic failover
Backup LDAP server
Regular database backup
Backup Strategy
slapcat
Backup configuration
Backup certificates
Backup LDIF
Test restore
Disaster recovery plan
Monitoring
LDAP availability
Authentication failures
Replication health
CPU
Memory
Disk
TLS certificate expiry
Login failures
Audit logs
Enterprise Best Practices
Use LDAPS only
Enable replication
Integrate with Kerberos
Use SSSD caching
Centralize sudo rules
Disable anonymous bind
Enforce TLS
Strong password policy
Monitor authentication logs
Regular backups
Least privilege
Regular audits
Enterprise Implementation Roadmap
Design domain structure
Build DNS
Configure NTP
Deploy LDAP servers
Configure replication
Enable TLS
Create Organizational Units
Create groups
Create users
Configure Linux clients
Configure SSSD
Configure PAM
Configure NSS
Test authentication
Configure sudo integration
Configure SSH access
Integrate applications
Enable monitoring
Enable backup
Document environment
LDAP Interview Preparation
What is LDAP
Difference between LDAP and Active Directory
Difference between LDAP and Kerberos
What is DN
What is RDN
What is Base DN
What is OU
What is CN
What is UID
What is DC
What is SSSD
What is NSS
What is PAM
What is LDAPS
Difference between LDAP and LDAPS
Authentication flow in Linux
How Linux authenticates LDAP users
LDAP ports
LDAP replication
LDAP security best practices
LDAP troubleshooting steps
How to verify LDAP user
How to integrate LDAP with sudo
How to integrate LDAP with SSH
Enterprise deployment strategy
High availability in LDAP
Backup and restore methods
Enterprise Scenario
New employee joins
Create LDAP user
Assign department
Assign groups
User logs into Linux servers immediately
Employee changes department
Update LDAP groups
Access changes automatically
Employee leaves company
Disable LDAP account
Access removed from every Linux server instantly
Interview Summary
LDAP provides centralized identity management
SSSD connects Linux to LDAP
NSS retrieves user information
PAM authenticates users
LDAP stores directory information
Kerberos provides secure authentication
LDAPS encrypts communication
Enterprise uses replication backup monitoring and least privilege