Directory services (Active Directory, LDAP) in Cybersecurity - Step-by-Step Execution

Concept Flow - Directory services (Active Directory, LDAP)

User or Device Request

↓

Query Directory Service

↓

Directory Service (Active Directory or LDAP)

↓

Search for User/Resource Info

↓

Return Info or Access Rights

↓

Grant or Deny Access

A user or device sends a request to the directory service, which searches its database and returns information or access rights.

Execution Sample

Cybersecurity

User requests login
Directory service receives query
Service searches for user info
Service returns user details
Access granted or denied

This shows the step-by-step process of how a directory service handles a login request.

Analysis Table

Step	Action	Description	Result
1	User sends login request	User enters username and password	Request sent to directory service
2	Directory service receives query	Service gets the login request	Ready to search user info
3	Search user info	Service looks up username in directory	User record found or not found
4	Verify credentials	Compare password with stored data	Match or mismatch
5	Return result	Send success or failure response	Access granted or denied
6	End	Process complete	User logged in or rejected

💡 Process stops after access is granted or denied based on credential verification

State Tracker

Variable	Start	After Step 1	After Step 3	After Step 4	Final
Request	None	Login request with username/password	User info lookup started	Credentials verified	Access result sent
User Info	None	None	User record found or not found	Password match or mismatch	Access granted or denied

Key Insights - 3 Insights

Why does the directory service need to search for user info before granting access?

Because the service must confirm the user exists and retrieve stored credentials to verify the login, as shown in step 3 of the execution_table.

What happens if the password does not match the stored data?

Access is denied immediately after verification in step 5, preventing unauthorized login.

Is the directory service only used for login requests?

No, directory services also provide information about users, devices, and resources for many network functions, but login is a common example.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result after step 3?

A Access granted or denied

B Login request sent

C User record found or not found

D Credentials verified

💡 Hint

Check the 'Result' column for step 3 in the execution_table.

At which step does the directory service verify the user's password?

A Step 4

B Step 2

C Step 5

D Step 3

💡 Hint

Look at the 'Action' column to find where credentials are checked.

If the user info is not found at step 3, what will happen next?

A Access granted

B Access denied at step 5

C Service searches again

D User is prompted to re-enter username

💡 Hint

Refer to the flow where missing user info leads to denial in the execution_table.

Concept Snapshot

Directory services store and manage user and resource info.
They respond to queries like login requests.
Active Directory and LDAP are common types.
They verify credentials and return access rights.
Used widely for network security and management.

Full Transcript

Directory services like Active Directory and LDAP help computers and users find information about users, devices, and resources on a network. When a user tries to log in, their request is sent to the directory service. The service looks up the user's information, checks the password, and then decides if access should be granted or denied. This process involves receiving the request, searching the directory, verifying credentials, and returning the result. Directory services are essential for managing access and security in networks.

Practice

1. What is the primary purpose of directory services like Active Directory or LDAP?

easy

A. To store and organize information about users and resources on a network

B. To provide antivirus protection for computers

C. To manage internet browsing history

D. To encrypt email messages automatically

Solution

1. Step 1: Understand directory services function

   Directory services are designed to keep track of users, computers, and other resources in a network.

2. Step 2: Identify the correct purpose

   Among the options, only storing and organizing network information matches the role of directory services.

3. Final Answer:

   To store and organize information about users and resources on a network -> Option A

4. Quick Check:

   Directory services = store network info [OK]

Hint: Directory services manage network users and resources [OK]

Common Mistakes:

• Confusing directory services with security software
• Thinking directory services handle internet browsing
• Assuming directory services encrypt emails

2. Which of the following is the correct protocol used by Active Directory to query directory information?

easy

A. HTTP

B. SMTP

C. FTP

D. LDAP

Solution

1. Step 1: Recall Active Directory protocols

   Active Directory uses LDAP (Lightweight Directory Access Protocol) to query and update directory data.

2. Step 2: Match protocol to options

   Among the options, only LDAP is the directory query protocol; HTTP, FTP, and SMTP serve other purposes.

3. Final Answer:

   LDAP -> Option D

4. Quick Check:

   Active Directory uses LDAP [OK]

Hint: LDAP is the directory query protocol for Active Directory [OK]

Common Mistakes:

• Choosing HTTP which is for web traffic
• Confusing FTP with file transfer only
• Selecting SMTP which is for email sending

3. Consider this LDAP query filter: (objectClass=user). What does this filter do when querying a directory?

medium

A. Returns all objects that are users

B. Returns all objects that are computers

C. Returns all objects with no class

D. Returns all objects that are groups

Solution

1. Step 1: Understand LDAP filter syntax

   The filter (objectClass=user) selects directory entries where the objectClass attribute equals 'user'.

2. Step 2: Identify what objectClass=user means

   This means the query returns all user objects, not computers or groups.

3. Final Answer:

   Returns all objects that are users -> Option A

4. Quick Check:

   LDAP filter (objectClass=user) = user objects [OK]

Hint: objectClass=user filter selects user entries [OK]

Common Mistakes:

• Thinking it returns computers or groups
• Misreading the filter syntax
• Assuming it returns all objects regardless of type

4. You wrote this LDAP query filter to find all groups: (objectClass=group). But it returns no results. What is the most likely reason?

medium

A. The filter syntax is incorrect and should be (objectClass==group)

B. You need to use (objectCategory=group) instead for better results

C. The directory does not contain any group objects

D. LDAP does not support filtering by objectClass

Solution

1. Step 1: Check LDAP filter syntax

   The syntax (objectClass=group) is correct, so syntax error is unlikely.

2. Step 2: Understand objectClass vs objectCategory

   In Active Directory, objectCategory is often more reliable for filtering groups than objectClass.

3. Step 3: Identify the best filter

   Using (objectCategory=group) usually returns group objects correctly.

4. Final Answer:

   You need to use (objectCategory=group) instead for better results -> Option B

5. Quick Check:

   Use objectCategory=group for groups [OK]

Hint: Use objectCategory=group to reliably find groups [OK]

Common Mistakes:

• Assuming no groups exist in directory
• Using double equals in LDAP filter
• Believing LDAP can't filter by objectClass

5. You want to create an LDAP query to find all users who are members of a specific group named "SalesTeam". Which filter correctly combines these conditions?

hard

A. (&(objectClass=group)(memberOf=SalesTeam))

B. (|(objectClass=user)(memberOf=SalesTeam))

C. (&(objectClass=user)(memberOf=CN=SalesTeam,OU=Groups,DC=example,DC=com))

D. (objectClass=user)(memberOf=SalesTeam)

Solution

1. Step 1: Understand LDAP filter operators

   The & operator means AND, | means OR. To find users who are members of a group, both conditions must be true.

2. Step 2: Analyze each filter

   (&(objectClass=user)(memberOf=CN=SalesTeam,OU=Groups,DC=example,DC=com)) correctly uses AND to combine user objects with the memberOf attribute matching the full distinguished name of the group. (|(objectClass=user)(memberOf=SalesTeam)) uses OR, which is incorrect. (objectClass=user)(memberOf=SalesTeam) lacks an operator to combine conditions. (&(objectClass=group)(memberOf=SalesTeam)) looks for groups, not users.

3. Final Answer:

   (&(objectClass=user)(memberOf=CN=SalesTeam,OU=Groups,DC=example,DC=com)) -> Option C

4. Quick Check:

   Use AND (&) with objectClass=user and full memberOf DN [OK]

Hint: Use & to combine user and memberOf filters with full DN [OK]

Common Mistakes:

• Using OR instead of AND to combine filters
• Not using full distinguished name in memberOf
• Filtering groups instead of users