A virtual directory is a server for a directory protocol such as LDAP, but unlike a traditional directory server, does not master the data itself in its own database. Instead a virtual directory will dynamically translate requests it receives to operations in other protocols or data models, such as to a relational database. Depending on an organization's needs - a virtual directory can complement or replace a metadirectory. Most virtual directories act as proxies. The virtual directory sits between an application and a set of authoritative sources to create a view of a user, generally through the LDAP protocol. Virtual directories may create a user view by joining a user's identity data or by integrating directory information. Typically a virtual directory will integrate with other LDAP directories, relational databases and network operating system directories. Potential advantages of virtual directories:
- Faster deployment by avoiding synchronization
- Leverage existing investments in security and high-availability for authoritative data stores
- Provide application specific views of identity data which can help avoid the need to develop a master enterprise schema
- Allow a single view of identity data without violating internal or external regulations governing identity data
- Act as identity firewalls - preventing denial of service attacks on the primary data-stores and providing further security on access to sensitive data
- Changes made in authoritative sources are reflected in real-time
Organizations that implement virtual directories need to be aware of the following potential deployment challenges:
- Having the virtual directory implementation augment the high availability of authoritative sources
- Meeting the latency and performance requirements which are dictated by the business requirements of the client applications
Some Typical Virtual Directory Terminology:
- Namespace Joining - The creation of a single large directory by bringing multiple directories together at the namespace level. For instance if one directory has the namespace "ou=internal,dc=domain,dc=com" and a second directory has the namespace "ou=external,dc=domain,dc=com" then creating a virtual directory with both namespaces is an example of namespace joining.
- Identity Joining - The creation of a user from various authoritative sources linked together by common data. For instance if the user joeuser exists in a directory as "cn=joeuser,ou=users" and in a database with a username of "joeuser" then the "joeuser" identity can be constructed from both the directory and the database.
- Mapping - The transformation of data inside of the virtual directory. For instance mapping uid to samaccountname.
- Identity Routing - Virtual directories may support the routing of requests based on certain criteria (such as write operations going to a master while read operations being forwarded to replicas).
- Authoritative Source - A "virtualized" data repository, such as a directory or database, that the virtual directory can trust for user data.
