What is LDAP; where is it used in TR7?

Short answer

LDAP (Lightweight Directory Access Protocol) is the standard protocol used to query users, groups and other objects in directory services such as Active Directory and OpenLDAP, and to verify a user's password by binding to the directory (RFC 4511). In TR7, it is used in four places: in AGS, application users are verified with an Authentication Provider of the LDAP type against the LDAP or LDAPS server on the Authentication Servers screen; management users whose Authorization Source value is LDAP are verified against the directory on the LDAP Settings screen; in Load Balancer and GTM health checks, the LDAP and LDAPS types check the directory server. Traffic going to LDAP servers can also be load balanced with an L7 TCP vService.

Where It Is Used in TR7

Where	Field / label	What for
AGS → Authentication → Authentication Providers	Provider Type = LDAP; Authentication Method (Search and Bind / Direct Bind)	Verifying the users who enter the application behind the AGS-enabled vService against the directory
AGS → Authentication → Authentication Servers	Protocol = LDAP / LDAPS	The address, port and TLS settings of the directory server that the LDAP-type provider connects to
Settings → User Management → LDAP Settings	LDAP Host, LDAP Port, TLS, LDAP Principal Pattern, Base DN	Login of management users to the TR7 interface with their directory account
Settings → User Management → Device Users	Authorization Source = LDAP	Which management user is verified against the directory in LDAP Settings
Load Balancer → Profiles → Health Checks and GTM → Health Checks	Check Type = LDAP / LDAPS; LDAP Authentication	Checking whether the directory server responds, optionally by binding with a user
Load Balancer → vService	L7 TCP vService	Distributing the traffic going to more than one LDAP server

Common Misconceptions

• "LDAP is a user database." LDAP is an access protocol; what holds the users is the directory service (e.g. Active Directory).
• "Management login and AGS use the same LDAP setting." Management users are verified with the LDAP Settings screen, and application users with the LDAP provider in AGS and the Authentication Servers record; the two are configured separately.
• "An LDAP health check guarantees that the server verifies users correctly." The health check checks whether the server responds; if LDAP Authentication is on, it attempts a bind with a single defined account. Details: Can authenticated / STARTTLS checks be done for LDAP, SMTP and FTP?

How it is done in the documentation

• LDAP · What Is LDAP?
• Authentication Servers · LDAP
• LDAP Settings · What Is LDAP Settings?
• Health Checks · LDAP

Related questions

• What is Active Directory; how does it relate to LDAP?
• What is the difference between LDAP and LDAPS?
• Can I load balance LDAP / Active Directory queries?
• Can authenticated / STARTTLS checks be done for LDAP, SMTP and FTP?