AD(Active Directory)

Active Directory is like the brain of an organization’s network. It’s a system developed by Microsoft to:

1. Store Information about objects: About users, computers, printers, and other resources in the network.
2. Control Access: Decide who can access which resources (e.g., files, applications, servers).
3. Centralize Management: Allow administrators to manage everything from one place.

Organizations use AD because it has

Centralised Control:

Imagine a company has 1,000 employees. Instead of managing each user’s access separately on every computer, AD does it all in one place.

Single Sign-On (SSO):

• Users log in only once with their AD credentials and gain access to all resources they’re authorised for.

Security:

• AD enforces strict security policies (ex: password rules and two-factor authentication) and makes it easy to disable a user’s account if needed.

Organized Network:

• AD organizes users, groups, computers, and devices into an easy-to-manage structure.
  

For example :

Imagine a large castle where many workers live and work. The castle has rooms, offices, libraries, and treasure vaults. The king (or queen) wanted to make sure:

1. Only authorised people could enter the castle.
2. People were allowed only into the rooms they needed.
3. Everything inside the castle was well-organized and easy to manage.

The king realised that just having guards at the doors wasn’t enough. The castle needed a system to manage all the people, permissions, and rules. And that’s how Active Directory (AD) was born.

Think of AD as a directory service that organizes and secures everything in your network. Here’s how it works:

1. The Castle's Directory:
   • AD mainly acts as a giant database that keeps track of all employees (users), departments (groups), and tools (resources) in the organization.
   • Example: "Lucy belongs to the Marketing team and has access to the Marketing Shared Drive and Email System."
2. Permissions and Rules:
   • AD sets rules to decide who can access what.
   • Example: Only the IT team can access the server room, and only HR can open the payroll folder.
3. Checks Authentication and Authorization:
   • When someone tries to log in, AD checks authentication(who are you) and authroization(What are you allowed to do)
4. Domain Controller (The Castle Guard):
   • AD uses a Domain Controller (DC)—a special server that handles all authentication requests.
   • Example: When a user logs in, the Domain Controller says, “Let me check if your username and password are correct” and gives them access if everything matches.

You may get doubt LDAP also offers centralized control, then why AD -> click here 

LDAP

The Problem Before LDAP

Once upon a time, every organisation had many systems in the world of computers and networks. There were email systems, file-sharing tools, company applications, and more.

The user should create a username and password for Every Application and the system.

As users create multiple passwords, they feel frustrated.

• "Users should remember ten different passwords."
• "if users change their job roles again, they need to update every system manually."

Even IT teams felt the pain and frustration because they had to Manage so many credentials and user accounts.

How do we ensure secure and centralised control of who can access what?"

Then here comes the problem solver : LDAP

What is LDAP?

LDAP stands for Lightweight Directory Access Protocol.

This protocol is used to access and manage directory information.

There would be a centralised directory storing all employee details, usernames, passwords, job roles, and permissions.

Instead of every system maintaining its list, they all just refer to LDAP.

Think of it as the reception desk at a large office building:

• The reception desk knows who works in the building (usernames and roles).
• When someone walks in and says, "I need access to the Sales department," the receptionist checks their credentials and lets them in.
• If they're not authorised, the receptionist says, "Sorry, you can't go there."

LDAP does the same for systems—it's the receptionist that manages access across the network.

LDAP works:

A Central Directory: LDAP created a single database that stored everything about users: their login credentials, groups they belonged to, and permissions.

• Example: If you're "Lucy," LDAP knows you're on the sales team, your email is "Lucy.doe@company.com," and your password is "Super123."

LDAP allows applications to query this central directory whenever needed.

• For instance, when you try to log into your company's intranet, the system asks LDAP, "Hey, is this John Doe? Is his password correct?"

LDAP then became a game changer because

It Simplifies:

• Instead of managing accounts in multiple places, everything is managed in one central directory.
• Employees log in once and can access email, shared drives, and apps seamlessly.

It is lightweight and flexible.

• It uses a fast, simple protocol that works efficiently over networks. This made LDAP perfect for both large and small organisations.

It Improves Security:

• As this is Centralised, IT teams can enforce strong password policies, track activity, and disable access instantly when needed.

It's Compatible with Everything:

• LDAP isn't tied to a specific platform. Whether you're using Windows, Linux, or cloud apps, LDAP works everywhere.

While LDAP started as a hero for on-premises systems, cloud computing introduced new challenges. Today, tools like Azure AD and Okta extend LDAP's capabilities for modern, cloud-based applications. But the original idea of a central, lightweight directory remains the same.