Virtual directory

From Wikipedia, the free encyclopedia

A virtual directory is a server for a directory protocol such as LDAP, but unlike a traditional directory server, does not master the data itself in its own database. Instead a virtual directory will dynamically translate requests it receives to operations in other protocols or data models, such as to a relational database.

Depending on an organization's needs - a virtual directory can complement or replace a metadirectory.

Most virtual directories act as proxies. The virtual directory sits between an application and a set of authoritative sources to create a view of a user, generally through the LDAP protocol. Virtual directories may create a user view by joining a user's identity data or by integrating directory information. Typically a virtual directory will integrate with other LDAP directories, relational databases and network operating system directories.

Potential advantages of virtual directories:

Faster deployment by avoiding synchronization
Leverage existing investments in security and high-availability for authoritative data stores
Provide application specific views of identity data which can help avoid the need to develop a master enterprise schema
Allow a single view of identity data without violating internal or external regulations governing identity data
Act as identity firewalls - preventing denial of service attacks on the primary data-stores and providing further security on access to sensitive data
Changes made in authoritative sources are reflected in real-time

Organizations that implement virtual directories need to be aware of the following potential deployment challenges:

How can the virtual directory implementation augment the high availability of authoritative sources
What is the latency and performance requirements client applications need to meet in order to function to meet business requirements

Some Typical Virtual Directory Terminology:

Namespace Joining - The creation of a single large directory by bringing multiple directories together at the namespace level. For instance if one directory has the namespace "ou=internal,dc=domain,dc=com" and a second directory has the namespace "ou=external,dc=domain,dc=com" then creating a virtual directory with both namespaces is an example of namespace joining.
Identity Joining - The creation of a user from various authoritative sources linked together by common data. For instance if the user joeuser exists in a directory as "cn=joeuser,ou=users" and in a database with a username of "joeuser" then the "joeuser" identity can be constructed from both the directory and the database.
Mapping - The transformation of data inside of the virtual directory. For instance mapping uid to samaccountname.
Identity Routing - Virtual directories may support the routing of requests based on certain criteria (such as write operations going to a master while read operations being forwarded to replicas).
Authoritative Source - A "virtualized" data repository, such as a directory or database, that the virtual directory can trust for user data.