Directory Service
A directory service is the system that stores an organization's identities and their attributes (users, groups, devices, service accounts) in one queryable database, and answers lookups and authentication requests from other systems. Most directory services follow the X.500 data model and are accessed with LDAP, which RFC 4511 describes as providing "access to distributed directory services that act in accordance with X.500 data and service models."
The best-known example is Active Directory Domain Services, which adds Kerberos authentication and Group Policy on top of the directory. Open-source options include OpenLDAP, 389 Directory Server and FreeIPA. Cloud directories, such as Microsoft Entra ID, Okta Universal Directory or JumpCloud, keep the "one source of identity" role but expose it through SAML, OIDC and SCIM instead of LDAP binds.
| A directory service | Not the same as |
|---|---|
| Stores identities and attributes, answers lookups | An identity provider, which authenticates users and issues tokens (many products do both) |
| The authoritative store for accounts | An HR system, which is usually the authoritative source for who is employed |
| Often the target of provisioning | An IGA tool, which decides who should have what |
It matters because the directory is tier zero: whoever controls it controls group membership, and therefore access to everything that trusts it. Legacy directories also carry most of the attack paths, such as Kerberoasting and delegation abuse, so moving apps from LDAP binds to federation is a security project as much as a modernization one. The terms "enterprise directory" and "master directory" usually mean the same thing: the one directory every other system synchronizes from.
See also: LDAP, Active Directory, top directory services solutions, open-source directory services, provisioning
Related on Start with Identity
- GlossaryRADIUS
RADIUS (Remote Authentication Dial-In User Service) is a protocol, defined in [RFC 2865](https://www.rfc-editor.org/info/rfc2865/), that network devices such as
- GlossaryService Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party. The se
- GlossaryIdentity Fabric
An identity fabric is an architecture, not a product: a set of identity services from one or more vendors (identity provider, governance, privileged access, orc
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl
- CVEFreeIPA anonymous LDAP write plants a Kerberos principal in the admins group
FreeIPA's self-managed OTP token ACI let an anonymous LDAP client create a token entry with extra attributes, which combined with a 389 Directory Server ACI fla
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the