IAM Essentials: Virtual Directory Services

Virtual directory services. This is a technology which is not as popular as directory service and other technologies within identity and access management, but is a essential technology for several use cases. What does it do? It allows you to create a virtual perspective at runtime on data that is hold in more than one directory. It also allows to then combine data.

So you might have one directory for employees and one for customers, and you can have so to speak a virtual directory, which is constructed at run time, which has both groups of users in it also allows you to select data from, for instance, one directory, if you want to. So only certain types of data, so maybe less critical data to a certain type of application or in a test environment you might select. And you also might modify some of the data on the fly by for instance, change in structure of data and other things, whatever is required here.

Virtual directory services integrate usually with a couple of directory services, but also with other types of services such as databases. So they frequently come with more than trust up and they expose more than trust up. The main capabilities is to provide a virtual view for read access by applications across one or more directory. The important thing is that you don't need to create a separate physical data store for directory data here. So it is not that you say, okay, because I want this combination.

I create another physical directory, which I have to run on a certain hardware and a virtual machine or whatever else, but you just do it at runtime. It's virtual. It doesn't exist as a physical data structure. So there's no replication of data, which reduces a lot of challenges because replicating data is always something which is challenging frequently as it comes with support for Cing of data, for scalable and very performant access to the data. So it can speed up things.

Sometimes there's also a support for right operations across multiple directories, which is a little bit more challenging because you have to ensure that then if you write data split to more than one directory, that either the entire transaction, the entire right operations done or rolled back Also pass through authentication. So authentication from an application through the virtual directory against modern. One of these directors is commonly supported. And as I already said, there usually is a broad protocol support beyond what commonly supported by standard directory services.

So APIs, rest space or SQL access are quiet, common.