Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between LDAP and LDAPS?
Short answer
LDAP connects to the directory server without encryption on the standard port 389; unless the connection is later encrypted with StartTLS, the password sent during bind travels over the network as clear text (RFC 4513). LDAPS, by contrast, carries the same protocol over a channel encrypted with TLS from the start; its standard port is 636 and the client can verify the server's certificate. An encrypted channel is preferred on every connection in which a password is sent to the directory. In TR7, LDAP or LDAPS is selected as Protocol in the AGS Authentication Servers form; with LDAPS, the Validate SSL Certificate (on by default) and Minimum TLS Version (1.2 by default) fields open. Since a new server row is added with port 389, the port is changed to 636 for LDAPS. For management users, when TLS is turned on on the LDAP Settings screen, the connection is established with LDAPS; if LDAP Port is left empty, 636 is used while TLS is on and 389 while it is off.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| AGS → Authentication → Authentication Servers | Protocol = LDAP / LDAPS; Server Hosts (port 389 in a new row) | AGS connecting to the directory without encryption or with encryption |
| Same form (LDAPS) | Validate SSL Certificate (on by default), Minimum TLS Version: 1.2 (default) / 1.3 | Checking the directory server's certificate and the TLS version |
| Settings → User Management → LDAP Settings | TLS (off by default), LDAP Port | LDAP or LDAPS connection for management users |
| Load Balancer → Profiles → Health Checks and GTM → Health Checks | Check Type = LDAP / LDAPS; with LDAPS, Verify Server Certificate (off by default) | Checking the directory server without encryption or over TLS |
| Load Balancer → vService | L7 TCP vService: TCP or TCP + TLS | Distributing 389 and 636 traffic; terminating LDAPS on TR7 |
Comparison
| LDAP | LDAPS | |
|---|---|---|
| Encryption | None (can be encrypted later with StartTLS) | TLS from the start of the connection |
| Standard port | 389 | 636 |
| Server certificate | Not used | Can be verified |
| AGS Authentication Servers | Protocol = LDAP | Protocol = LDAPS, additional TLS fields |
| LDAP Settings | TLS off | TLS on |
Common Misconceptions
- "The password in an LDAP connection is already encrypted." In unencrypted LDAP, the bind password travels over the network as clear text; the AGS LDAP provider documentation also recommends LDAPS (LDAP · Operational Best Practices).
- "To switch to LDAPS, changing only the port is enough." In Authentication Servers, Protocol is also set to LDAPS; in LDAP Settings, TLS is turned on. While Validate SSL Certificate is on, the directory server's certificate must be verifiable.
- "The LDAP health check performs an encrypted check with StartTLS." There is no StartTLS in the LDAP health check type; the LDAPS type is used for an encrypted check (Can authenticated / STARTTLS checks be done for LDAP, SMTP and FTP?).
How it is done in the documentation
