LDAP stands for Lightweight Directory Access Protocol. It is a software protocol that is used to enable anyone to locate organizations, individuals, and other resources such as files and devices in a network, whether on the public internet or on a corporate intranet. LDAP is a lightweight version of Directory Access Protocol (DAP), which is part of X.500, a standard for directory services in a network.

A directory is a specialized database optimized for reading, browsing and searching, as opposed to transactional operations typical in a relational database. Directories tend to contain descriptive, attribute-based information and support sophisticated filtering capabilities. Directories generally do not support complicated transaction or roll-back schemes found in database management systems designed for handling high-volume complex updates.

LDAP information is hierarchically organized in a structure called Directory Information Tree (DIT). The DIT contains entries (nodes) which are composed of attributes. Each attribute has a name and one or more values. Entries are uniquely identified by their Distinguished Name (DN), which is constructed by taking the name of the entry itself (called the Relative Distinguished Name, or RDN) and concatenating the names of its ancestor entries.

LDAP is widely used for a variety of tasks like authentication and authorization, storing user profiles, and so on. For example, when you log into a computer that’s part of a Windows domain, LDAP is used to check your username and password. If they match the username and password on the domain controller (which is stored in its LDAP directory), you’re granted access to the computer.

LDAP servers index all the data in their entries, and “filters” may be used to select just the person or group you want, and return just the information you want. This makes LDAP an effective protocol for accessing and managing directory information.