Port 389 serves LDAP directories such as OpenLDAP, 389 Directory Server and Active Directory. Nextcloud, mail servers and VPNs look up users and groups here. Encrypt with StartTLS (ldap:// plus -ZZ) or use port 636.
LDAP never belongs on the internet. Allow it only for the servers that need to authenticate. UDP 389 (CLDAP) is used by AD and has been abused for amplification attacks.
Common errors: Invalid credentials (49) due to a wrong bind DN, and simple binds without TLS rejected after AD hardening (LDAP signing / channel binding).
Check
ldapsearch -x -H ldap://ldap.example.com -b "" -s base namingContexts