When using LDAP as an authentication method for Identity Awareness, the query:

LDAP queries require no client-side software; the gateway independently contacts the directory server without any endpoint agent.

LDAP identity acquisition does not prompt the user for credentials; it queries the directory using existing session or machine identity data.

While LDAP traffic must be permitted to flow, this option misstates the defining characteristic of LDAP queries in Identity Awareness, which is their transparency and lack of client intervention.

LDAP identity queries in Identity Awareness are fully transparent because the Security Gateway directly queries Active Directory or another LDAP server in the background to resolve user identity. No software needs to be installed on client machines or the LDAP server itself, and users do not receive any prompt or need to take action. This makes LDAP a passive, non-intrusive identity acquisition method.