Home > Directory service

A directory service maps the names of network resources to their respective network addresses. Similar to a domain name service, the user doesn't have to remember the physical address of a network resource; providing a name helps locate the resource. Each resource on the network is considered as an object on the directory server. Information about a particular resource is stored as attributes of that object. Information within objects can be made secure so that only users with the available permissions are able to access it.

A directory service defines the namespace for the network. A namespace is a set of rules that determine how network resources are named and identified. The rules specify that the names be unique and unambiguous. In LDAP, such a name, called as distinguished name (DN) is used to refer to a collection of attributes which make up a directory entry.

1 Relational Databases

There is a number of things that distinguishes a directory service from a relational database

• In a directory, the information is generally read more often than it is written. Hence the usual database features of transactions and rollback are not implemented in a directory. Data may be made redundant, but the objective is to get a faster response time during searches.
• Data is organized in a strictly hierarchical manner. In terms of cardinality, directories do not have many-to-many relations. Instead, such relations must be maintained explicitly using lists of distinguished names.
• Attributes are defined as stand-alone schema entities. That is: they exist without being part of an object and have a fixed type.
• An objectClass has:
  • Must-attributes that each of its instances must have
  • May-attributes that can be defined for an instance, but could also be omitted when the object is created. The lack of a certain attribute is somewhat like a NULL in relational databases
• Attributes are often multi-valued in directories whereas this is seen in relational database design as a denormalized state of the database schema.
• Attributes and objectClasses are standardized throughout the industry and formally registered with the IANA for their object ID. Therefore directory applications seek to reuse much of the standard classes and attributes to maximize the benefit of existing directory server software.
• Object instances are slotted into namespaces. That is, each objectClass inherits from its parent objectClass (and ultimately from the root of the hierarchy) adding attributes to the must/may list.
• Directory services are often a central component in the security design of an IT system and have a correspondingly fine granularity regarding access control: who may operate in which manner on what information. Also see: ACLs

Directory design, compared to relational databases, therefore feels much more like customizing an industry-standard rather than a conceptualization of a real-life situation. Different rules apply regarding data modeling and the access scenarios are different.

2 Implementations of Directory Services

Directory services were part of an Open Systems Interconnect (OSI) initiative to get everyone in the industry to agree to common network standards to provide multi-vendor interoperability. In the 1980s the ITUThe International Telecommunication Union (ITU) is an international organization established to standardize and regulate international radio and telecommunications, founded as the International Telegraph Union in Paris in May 17, 1865. Its main tasks incl and ISOThe International Organization for Standardization ISO or Iso is an international standard-setting body made up of representatives from national standards bodies. Founded in February 23, 1947, the organization produces world-wide industrial and commercial came up with a set of standards - X.500500 is the set of ITU-T computer networking standards covering electronic directory services such as white pages, Knowbot and whois. 500 was jointly developed with ISO as part of the Open Systems Interconnect suite of protocols, in order to support the re, for directory services, initially to support the requirements of inter-carrier electronic messaging and network name lookup. The Lightweight Directory Access Protocol, LDAPLightweight Directory Access Protocol LDAP is a protocol for accessing on-line directory services. The IETF designed and specified LDAP as a better way to make use of X. 500 directories having found the original Directory Access Protocol (DAP) too complex, is based on the services of X.500, but uses the TCP/IP stackThe Internet protocol suite is the set of protocols that implement the protocol stack on which the Internet runs. It is sometimes called the TCP/IP protocol suite, after the two most important protocols in it: the Transmission Control Protocol (TCP) and t, giving it more relevance on the InternetThis article is about the Internet the extensive, worldwide computer network available to the public. An internet is a more general term for a set of interconnected computer networks that are connected by internetworking''. WWW information network structu.

The Network Information ServiceThe Network Information Service or NIS is Sun Microsystems' " Yellow Pages" (YP) client-server directory service protocol for distributing system configuration data such as user and host names between computers on a computer network. NIS/YP is used for ke (NIS) protocol, originally named Yellow PagesYellow Pages or YP as is commonly known, was the original name for the Network Information Service (NIS), a directory service created by Sun Microsystems. Nowadays it is mostly called NIS or NIS+. See Also Network Information Service. (YP) was Sun Microsystems implementation of a directory service for Unix network environments. Sun has in recent years acquired iPlanet from Netscape and developed its directory service to become part of Sun ONE, now called Sun Java Enterprise.

There are plently of open-source tools to create directory services, including OpenLDAP and the Kerberos (protocol), and Samba_software which can act as a Domain Controller with Kerberos and LDAP back-ends.