For managed services providers (MSPs), Active Directory (AD) and Lightweight Directory Access Protocol (LDAP) are kitchen sink terms. So common and familiar are they that we rarely bother to discuss their functions and how to use them most effectively. This is unfortunate, if for no other reason than the fact that AD and LDAP are critical to all the work that we do as IT experts—within our own organizations and with our customers. For this reason, it is imperative that we understand these concepts thoroughly and reflect seriously on how they can be applied most effectively within our organizations.
To help facilitate this reflection and understanding, we have decided to lay out some of the key differences between AD and LDAP and explain the important relationships between them.
Defining Active Directory
In our digital age, phone books are increasingly a rarity. The days of flipping through the yellow pages in search of your local pizza shop’s phone number are well behind us. However, although physical phone books are now essentially irrelevant, the concept of a phone book—a directory for accessing the contact information of anyone who has consented to make this information available—remains with us. Let’s say, for instance, someone works for a company or organization and wants to find the email address of a colleague. What is the equivalent of a modern day phone book in this context?
Nowadays, if they were on a Windows network they would turn to Active Directory (AD). AD is a directory service product developed by Microsoft exclusively for Windows. It provides an interface for organizing and managing objects on a shared network—meaning desktop and laptop computers, devices, printers, and services, as well as user and user groups. Embedded within this, users or groups of users are assigned a set of privileges that afford them access to information and objects in the directory. In our phone book example, a user could utilize their company’s AD to track down their colleague’s contact information.
ADs are structured around domains, trees, and forests. At the lowest level, domains contain sets of objects. Domains are defined as a logical group of network objects, such as computers, devices, or users, that share the same AD database. At the middle level, trees are hierarchical collections of one or more domains. And at the highest level, forests are hierarchical groupings of trees that share the same global catalog and directory schema. This hierarchical structure often mirrors the structure of the company or organization the AD serves.
What Is the Difference Between LDAP and Active Directory?
So we’ve established that an AD is a services directory akin to a phone book. What about LDAP? In short, in order for a directory like AD to function it is necessary to have a protocol in place for querying it, maintaining it, and authenticating access to it. One such protocol is LDAP, or Lightweight Directory Access Protocol. As its name suggests, LDAP is a lightweight client-server protocol used to access directory services.
LDAP functions as an excellent protocol solution for AD. However, it is important to mention it is capable of interacting with other directory services and access management solutions as well. LDAP was first developed by Tim Howes, chief technology officer at ClearStory Data, and his colleagues. At the time, the expectation was that online users would create separate accounts for all of the different online services they sought to access and use (e.g., email or web services).
It just so happens that Howes was working on his PhD in computer science at the University of Michigan at the time. The university asked him to develop an X.500 directory for the campus. Realizing the initial protocol was extraordinarily heavy and complicated for the software most people ran, he set out to develop something “a little lighter weight to accommodate the Macs and PCs that were on everybody’s desktop.” The rest is history.
What Howes ultimately produced was an open and cross-platform application protocol used over an IP network to manage and access directory information. This protocol allows users to access the kind of important, internal information that might be stored in an AD. Unlike a phone book, this information is not limited to name, address, and phone number alone. It often includes email address, title, department, length of time with the company, and much more. LDAP also enables permission for users to access resources like printers that share the same network.
What Is the Role of LDAP in Active Directory?