Are there benefits to using LDAP for Auth for a single application?

I worked on a project a while back where the Architect decided to use LDAP for managing authentication / authorization, rather than a traditional database approach.

The application was expected to scale rapidly by approx 500 - 1000 users a day, and then plateau at around 200k users. Beyond that, there was nothing special about this application.

I didn't ask at the time, but I'm curious around why we would've used LDAP here.

As I u开发者_如何学运维nderstand it, the real strengths of LDAP lie in organizations where users are required to authenticate against several disconnected systems, and LDAP provides a single auth provider.

Are there additional benefits that make it a good fit for certain applications?

---

Actually, the scaling is one: LDAP is easily distributed across multiple servers.

The other reason, whether your architect mentioned it or not, is that there's never in the history of the world been a single application that stayed single. Someone will have a new idea, and now there's a unified single sign on technique already available and standard.

---

LDAP is incredibly fast for read operations compared with your average RDBMS. Auth operations are read intensive and generally change data infrequently - which is well suited for ldap's strengths. On the flip side, write operations are generally much slower than their database counterparts.

So, while LDAP would most likely not be an adequate alternative for your general data storage needs, it is a strong choice for auth.

---

I wouldn't call the database solution for users 'traditional': in fact I would call LDAP traditional in this case. It is much better as a user registry in all sorts of ways, including performance, standardisation, availability of APIs, availability of browser clients, ease of scaling/federation, security, ...