Directory service

A Directory service organizes content in a directory server into a logical and accessible structure. It provides a single, consistent database in which to store information about the network and all network-based resources - users, servers, files, printers, shares, etc. It acts as a central authority that can securely authenticate resources and manage identities and relationships between them.

A directory service maps the names of network resources to their respective network addresses. Similar to a domain name service, the user doesn't have to remember the physical address of a network resource; providing a name helps locate the resource. Each resource on the network is considered as an object on the directory server. Information about a particular resource is stored as attributes of that object. Information within objects can be made secure so that only users with the available permissions are able to access it.

A directory service defines the namespace for the network. A namespace is a set of rules that determine how network resources are named and identified. The rules specify that the names be unique and unambiguous. In LDAP, such a name, called as distinguished name (DN) is used to refer to a collection of attributes which make up a directory entry.

Comparison with relational databases

There is a number of things that distinguishes a directory service from a relational database

• In a directory, the information is generally read more often than it is written. Hence the usual database features of transactions and rollback are not implemented in a directory. Data may be made redundant, but the objective is to get a faster response time during searches.
• Data is organized in a strictly hierarchical manner. In terms of cardinality, directories do not have many-to-many relations. Instead, such relations must be maintained explicitly using lists of distinguished names.
• Attributes are defined as stand-alone schema entities. That is: they exist without being part of an object and have a fixed type.
• An objectClass has:
  • Must-attributes that each of its instances must have
  • May-attributes that can be defined for an instance, but could also be omitted when the object is created. The lack of a certain attribute is somewhat like a NULL in relational databases
• Attributes are often multi-valued in directories whereas this is seen in relational database design as a denormalized state of the database schema.
• Attributes and objectClasses are standardized throughout the industry and formally registered with the IANA for their object ID. Therefore directory applications seek to reuse much of the standard classes and attributes to maximize the benefit of existing directory server software.
• Object instances are slotted into namespaces. That is, each objectClass inherits from its parent objectClass (and ultimately from the root of the hierarchy) adding attributes to the must/may list.
• Directory services are often a central component in the security design of an IT system and have a correspondingly fine granularity regarding access control: who may operate in which manner on what information. Also see: ACLs

Directory design, compared to relational databases, therefore feels much more like customizing an industry-standard rather than a conceptualization of a real-life situation. Different rules apply regarding data modeling and the access scenarios are different.

Implementations of Directory Services

Directory services were part of an Open Systems Interconnect (OSI) initiative to get everyone in the industry to agree to common network standards to provide multi-vendor interoperability. In the 1980s the ITU and ISO came up with a set of standards - X.500, for directory services, initially to support the requirements of inter-carrier electronic messaging and network name lookup. The Lightweight Directory Access Protocol, LDAP, is based on the services of X.500, but uses the TCP/IP stack, giving it more relevance on the Internet.

The Network Information Service (NIS) protocol, originally named Yellow Pages (YP) was Sun Microsystems implementation of a directory service for Unix network environments. Sun has in recent years acquired iPlanet from Netscape and developed its directory service to become part of Sun ONE, now called Sun Java Enterprise.

Novell's implementation of directory services NDS supports multiple architectures among them Windows, Netware, several flavours of Unix, AS/400 and Linux and has long been used for user administration, configuration management, and software management. NDS has evolved into a central component in a broader range of Identity management products. NDS was renamed into eDirectory upon this occasion.

Microsoft's directory service is the Active Directory which is included in the Windows 2000 and Windows Server 2003 operating system versions.

There are plenty of open-source tools to create directory services, including OpenLDAP and the Kerberos (protocol), and Samba software which can act as a Domain Controller with Kerberos and LDAP back-ends.