LDAP

Port 389 talks to the local AD server, and can see the local AD tree. Port 3289 talks to the 'Global Directory' on the AD server - if the option is enabled, and can see the whole forest if you have more than one tree in the directory - of course the other trees would be on other servers - but the info is consolidated into one forest.

Jxplorer - good open source LDAP browser

sAMAccountName attribute is used to store user name in Active Directory

"protocol://hostname:port/base?attribute?scope?filter" NONE

http://www.jejik.com/articles/2007/06/apache_and_subversion_authentication_with_microsoft_active_directory/