Bind is the LDAP operation that establishes an identity on a connection. Every meaningful LDAP session starts with a bind, even if that bind is anonymous.
The most common form is a simple bind: the client sends a DN and a password, and the server checks them against the entry's stored credentials.
Bind DN: CN=Jane Doe,OU=Users,DC=example,DC=com
Password: ••••••••
If the DN exists and the password matches, the bind succeeds and the connection is now authenticated as that user for as long as the connection stays open (or until another bind replaces it). If either is wrong, the server returns a result code of 49 (invalidCredentials).
LDAP Error Decoder
Decode a result code if you see one in a log.
Security
A simple bind sends the password in plaintext over the connection. Always perform simple binds over LDAPS or STARTTLS — see LDAP vs LDAPS.
A client can also bind with no DN and no password, called an anonymous bind. Many servers allow this for limited, read-only lookups (or disable it entirely, for security reasons). Anonymous bind is useful for things like checking whether the server is reachable, but shouldn't be relied on for anything sensitive.
It's worth separating two things that both use the bind operation, because they're easy to conflate:
- Service account bind — your application authenticates once, as a fixed service account, and then performs searches on behalf of many users (for example, looking up someone's group membership).
- User bind (login check) — to verify a user's own password, your application binds as that user, using the password they just typed into a login form. If the bind succeeds, the password was correct. This is the standard pattern for "log in with your company directory credentials," and it's covered concretely in Authentication with ldapjs.
These are often combined: bind as a service account to search for the user's DN by username, then bind again as that DN with the submitted password to verify it.
Beyond simple binds, LDAP also supports SASL (Simple Authentication and Security Layer) binds, which allow mechanisms like Kerberos (GSSAPI) or external TLS client certificates. These are common in tightly integrated Windows environments but are outside the scope of this guide — simple bind covers the overwhelming majority of application use cases.
Once you're bound, the next step is usually finding entries. Continue to Searching.