Editing Lightweight Directory Access Protocol (section)

==Protocol overview==
A client starts an LDAP session by connecting to an LDAP server, called a [[Directory System Agent]] (DSA), by default on [[Transmission Control Protocol|TCP]] and [[User Datagram Protocol|UDP]] [[Port (computer networking)|port]] 389, or on port 636 for [[LDAPS]] (LDAP over TLS/SSL, see below).<ref>{{Cite web|url = https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=ldap|title = Service Name and Transport Protocol Port Number Registry|publisher = [[IANA]]|access-date = 24 March 2021}}</ref> The client then sends an operation request to the server, and a server sends responses in return. With some exceptions, the client does not need to wait for a response before sending the next request, and the server may send the responses in any order. All information is transmitted using [[Basic Encoding Rules]] (BER).

The client may request the following operations:
* [[StartTLS]] – use the LDAPv3 [[Transport Layer Security]] (TLS) extension for a secure connection
* Bind – [[authenticate]] and specify LDAP protocol version
* Search – search for and/or retrieve directory entries
* Compare – test if a named entry contains a given attribute value
* Add a new entry
* Delete an entry
* Modify an entry
* Modify Distinguished Name (DN) – move or rename an entry
* Abandon – abort a previous request
* Extended Operation – generic operation used to define other operations
* Unbind – close the connection (not the inverse of Bind)

In addition the server may send "Unsolicited Notifications" that are not responses to any request, e.g. before the connection is timed out.

A common alternative method of securing LDAP communication is using an [[Secure Sockets Layer|SSL]] [[tunneling protocol|tunnel]]. The default port for LDAP over SSL is 636. The use of LDAP over SSL was common in LDAP Version 2 (LDAPv2) but it was never standardized in any formal specification. This usage has been deprecated along with LDAPv2, which was officially retired in 2003.<ref>[http://tools.ietf.org/html/rfc3494 RFC3494]</ref>