Reference
Secure LDAP in Google Workspace
Secure LDAP lets legacy applications authenticate against Google Workspace as their directory over LDAPS on port 636, using a certificate issued per client. It is included with Enterprise and Education editions, and it is the opposite direction of travel from Google Cloud Directory Sync, which imports an existing LDAP directory into Workspace.
| Protocol | LDAPS over TLS on port 636 |
|---|---|
| Editions | Enterprise and Education editions; not Business editions |
| Authentication | Client certificate issued in the admin console, per application |
| Direction | Workspace acts as the directory; applications query it |
| Contrast with GCDS | Directory Sync pushes an on-premises directory into Workspace instead |
| Typical clients | VPN concentrators, NAS appliances, Jira, older on-premises software |
When Secure LDAP is the right answer
Use it when an application cannot speak SAML or OIDC and would otherwise need its own user database. A VPN appliance or a network storage device authenticating against Workspace directly removes an entire parallel set of credentials from the estate.
Where the application does support SAML, use SAML. Modern federation gives conditional access and session control that an LDAP bind cannot.
The mistakes that cost a weekend
Certificates expire. A Secure LDAP client certificate with no calendar reminder attached will take down VPN authentication on the day it lapses, usually outside working hours.
Access scope is the second trap: a client can be granted the entire directory when it needs one organisational unit or one group. Narrow the scope at creation, because widening later is easier than explaining why an appliance could read every user record.
What we see that others don't say
Expired Secure LDAP client certificates are the most common cause of sudden VPN authentication failure we are called about in Workspace estates, ahead of any change made in the admin console.
What this doesn't cover
- Secure LDAP requires an Enterprise or Education edition; Business editions cannot enable it at any seat count.
- It authenticates and reads directory data; it does not write user changes back into Workspace.
Want this done for you?
Three fields. We come back with whether this is a 20-minute fix or a project, and what it costs.
Prefer to talk? Call +44 20 7183 3436 (Mon–Fri 08:00–18:00 GMT), or message WhatsApp +44 7403 423563.
Questions we get asked
- Which Google Workspace editions include Secure LDAP?
- Enterprise and Education editions include Secure LDAP. Business Starter, Standard and Plus do not, so tenants on those editions need an identity provider in front of the application instead.
- Is Secure LDAP the same as Google Cloud Directory Sync?
- No, they run in opposite directions. Directory Sync reads an on-premises LDAP directory and provisions users into Workspace. Secure LDAP makes Workspace itself the directory that other applications authenticate against.
How this page is verified
Reviewed by Workspace Migration Services security desk, Workspace security and compliance reviewers. Last checked .
- Edition availability and port details verified against Google's Secure LDAP documentation at the review date.
- Failure pattern drawn from support incidents we have handled on Workspace tenants.
Sources you can check
Related pages
Legacy application still holding its own passwords?
We map every application authenticating outside Workspace, decide per application between SAML and Secure LDAP, and implement it with certificate renewal scheduled.