LDAP session replay is an attack vector that exploits the ability to capture a valid authentication exchange over LDAP and inject it later to gain unauthorized access. It bypasses normal credential prompts because the payload is already signed and trusted. If your directory services accept it, the intruder signs in as if nothing happened.
In most LDAP configurations, session replay risk comes from plaintext binds, weak channel binding policies, or insufficient use of TLS. Captured packets can be stored and resent using network tools with minimal modification. Once replayed, the server reads them as fresh, valid sessions.
Mitigation starts with enforcing LDAPS (LDAP over TLS) or StartTLS with strong cipher suites. Use SASL mechanisms like GSSAPI or DIGEST-MD5 with replay protection. Enable strict channel binding to tie authentication to the TLS channel, making replays useless outside that session. Audit logs should flag identical bind requests on suspicious intervals. Deploy intrusion detection systems that can parse and correlate LDAP traffic patterns.