---
description: What is Directory Services ?
---

# Idea of Directory Services

<figure><img src="https://3849832254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VV5UVf1Opf7lSgalz6c%2Fuploads%2FcVQsrtlcDwngPHgvWkwh%2Fcommercial-directories-service-1000x1000.webp?alt=media&#x26;token=e0cef6bc-976c-4568-9605-fedb4a24a0ff" alt=""><figcaption><p>directory Service Diagram </p></figcaption></figure>

## What is a Directory Service? <a href="#what-is-a-directory-service" id="what-is-a-directory-service"></a>

> <mark style="background-color:blue;">A</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">**directory service**</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">is a centralized database that stores, organizes, and provides access to information about networked resources (users, devices, applications, etc.). It acts as a "phonebook" for the network, enabling:</mark>
>
> * <mark style="background-color:blue;">**Authentication**</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">(verifying identities).</mark>
> * <mark style="background-color:blue;">**Authorization**</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">(granting access rights).</mark>
> * <mark style="background-color:blue;">**Resource discovery**</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">(locating printers, servers ,.....).</mark>
> * <mark style="background-color:blue;">**Policy enforcement**</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">(password rules ,....).</mark>



## **"Directory" vs "Service" ?**

### <mark style="color:blue;">**Directory**</mark>**&#x20;:**

> A <mark style="color:blue;">**directory**</mark> in this context is **not** a file system folder. Instead, it is a specialized, hierarchical database optimized for **read-heavy operations**. used to store and organize information about **users**, **computers**, **networks**, **applications**, **permissions**, Data is stored as **objects** (a user) with **attributes** (`username=john`, `email=john@example.com`).

### <mark style="color:blue;">**Service**</mark>:

> 1- A <mark style="color:blue;">**service**</mark> is a software component running on a server that performs a specific task — in this case, **handling directory-related requests**.
>
> 2- The software that manages the directory, handling requests like:
>
> * User authentication.
> * Data queries ("Find all printers in Building A").
> * Updates ( resetting a password).



## What is a _Directory Service_?

> ### <mark style="background-color:blue;">A</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">**Directory Service**</mark> <mark style="background-color:blue;"></mark><mark style="background-color:blue;">is:</mark>
>
> * A <mark style="color:blue;">**centralized database**</mark> of information about network resources (users, computers, groups,...)
> * A <mark style="color:blue;">**server-based service**</mark> that responds to **directory requests** (like login validation or permission checks).
> * Typically uses **LDAP** protocol.
>
> #### &#x20; <mark style="background-color:blue;">Key Functions:</mark>
>
> * Authentication & Authorization
> * User/group management
> * Computer management
> * Policy enforcement



## Types of Directory Services ?

| Directory Service            | Description                                               |
| ---------------------------- | --------------------------------------------------------- |
| **Active Directory (AD)**    | Microsoft’s directory service for Windows domain networks |
| **OpenLDAP**                 | Open-source implementation of LDAP                        |
| **eDirectory**               | Novell’s enterprise directory service                     |
| **Apache Directory**         | Java-based LDAP server                                    |
| **Red Hat Directory Server** | LDAP-based enterprise directory by Red Hat                |



## Interaction between (Directory Client ↔ Directory Server) ?

<figure><img src="https://3849832254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VV5UVf1Opf7lSgalz6c%2Fuploads%2FPHQpVr0R7DvmabYUTtZd%2Fimage.png?alt=media&#x26;token=091954d9-7c34-4ab1-a711-2623123bd899" alt=""><figcaption><p>Client &#x26; Server</p></figcaption></figure>

### Client-Server Interaction Flow:

1. <mark style="color:blue;">**Client (computer or app)**</mark> <mark style="color:blue;"></mark><mark style="color:blue;">wants to:</mark>
   * Log in a user
   * Check permissions
   * Find user info
2. <mark style="color:blue;">**Sends a request to Directory Server**</mark>
   * Usually via **LDAP** (Lightweight Directory Access Protocol)
3. <mark style="color:blue;">**Directory Server responds**</mark>
   * Authenticates or rejects
   * Returns data (e.g., user’s department)
4. <mark style="color:blue;">**Client acts based on response**</mark>

## **What is a Directory Client?**

> A **directory client** is software that interacts with the directory service. Examples:
>
> * **OS Components**: Windows logon client, lsass Process , .....).
> * **Applications**: Email clients (Outlook), SSO systems, custom scripts.
> * <mark style="color:blue;">**Functions**</mark><mark style="color:blue;">:</mark>
>   * Sends queries (LDAP searches).
>   * Authenticates users (via Kerberos/LDAP binds).
>   * Enforces group policies (in Windows).



## Protocols Used in Directory Services

| Protocol                                         | Description                                                    |
| ------------------------------------------------ | -------------------------------------------------------------- |
| **LDAP** (Lightweight Directory Access Protocol) | Main protocol for querying and modifying directory information |
| **LDAPS**                                        | Secure version of LDAP over SSL/TLS                            |
| **Kerberos**                                     | For secure authentication (used with Active Directory)         |
| **NTLM**                                         | Older Windows authentication protocol                          |
| **DNS**                                          | Used to locate directory servers (especially in AD)            |

### **LDAP Operations**:

1. **Bind**: Authenticate the client to the server
2. **Search**: Query the directory for entries
3. **Compare**: Check if a value matches
4. **Modify**: Update an entry
5. **Add/Delete**: Insert or remove entries



## **Does Active Directory Exist on the Directory Client?**

> <mark style="background-color:blue;">**No.**</mark>

* <mark style="color:blue;">**Active Directory (Directory Service)**</mark> runs exclusively on **Windows Server** machines (Domain Controllers).
* **Clients** (Like Windows 10/11 PCs) have:
  * <mark style="color:blue;">**Client-side components**</mark>: Like the `lsass.exe` process, which handles authentication _requests_ to AD servers.
  * <mark style="color:blue;">**Group Policy Client**</mark>: Applies policies from AD to the local machine, like <mark style="background-color:blue;">Group Policy Client Service (gpsvc).</mark>
  * <mark style="color:blue;">**LDAP/Kerberos libraries**</mark>: To communicate with AD servers.

<mark style="color:blue;">**Analogy**</mark><mark style="color:blue;">:</mark>

> Your web browser (client) accesses Google (server). Google doesn’t "exist" on your device , it responds to requests. Similarly, AD resides on servers, while clients use lightweight agents to talk to it.

## **What&#x20;**_**Does**_**&#x20;Exist on the Directory Client: The "AD Client Agents"**

<figure><img src="https://3849832254-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F0VV5UVf1Opf7lSgalz6c%2Fuploads%2F7VJFqEsUcOwTQQ3i8SjN%2Fimage.png?alt=media&#x26;token=685a3e2d-7928-4232-b2c6-7e6aa2f2be96" alt=""><figcaption></figcaption></figure>

> <mark style="color:blue;">Clients (Windows, macOS, Linux) run lightweight software components that act as intermediaries. Think of them as "ambassadors" for the AD server:</mark>
>
> #### <mark style="background-color:blue;">**Core Components on Windows Clients :**</mark>

| **Component**                     | **Purpose**                                          | **Technical Details**                                                                                     |
| --------------------------------- | ---------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| **`LSASS.EXE`**                   | **Local Security Authority Subsystem**               | Handles authentication requests. Talks to DCs via Kerberos/LDAP.                                          |
| **Group Policy Client (`gpsvc`)** | Applies Group Policy Objects (GPOs) from AD.         | Downloads policies from `\\domain\SYSVOL---->On DC` and enforces them locally.                            |
| **NetLogon Service**              | Establishes secure channel with DCs.                 | Uses [Netlogon protocol](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc) over RPC. |
| **LDAP/Kerberos Libraries**       | Protocol implementations for directory queries/auth. | Built into Windows APIs (e.g., `Secur32.dll`, `Wldap32.dll`).                                             |
| **Credential Cache**              | Stores recent Kerberos tickets/password hashes.      | Enables offline logins (cached credentials). Stored in secure memory (not disk).                          |

#### <mark style="background-color:blue;">**Non-Windows Clients (e.g., Linux/macOS)**</mark>

* **sssd (System Security Services Daemon)**: Integrates with AD/LDAP/Kerberos.
* **realmd**: Joins Linux clients to AD domains.
* **Samba**: Provides SMB/CIFS and NetLogon emulation.



## **Protocols Used by Client Agents**

| **Protocol** | **Used By**         | **Client-Side Process**                                     |
| ------------ | ------------------- | ----------------------------------------------------------- |
| **Kerberos** | `LSASS.EXE`         | Authentication via TGTs/service tickets (ports 88/TCP/UDP). |
| **LDAP**     | Apps/APIs           | Queries user/group data (port 389/636).                     |
| **SMB**      | Group Policy Client | Downloads GPOs from `\\domain\SYSVOL` (port 445).           |
| **RPC**      | NetLogon Service    | Secure channel maintenance (dynamic ports).                 |



## Understanding Read-Heavy Operations in Directory Services

> Directory services act like **digital phone books** for computer networks, storing information about users, devices, and resources (Like usernames, passwords, permissions) ."<mark style="color:blue;">**read-heavy operations**</mark>" means these systems are designed to handle far more **lookup requests** (reads) than updates or changes (writes).&#x20;

### Why Directories Are "Read-Heavy" <a href="#why-directories-are-read-heavy" id="why-directories-are-read-heavy"></a>

### 1. **Everyday Use Cases**

Most interactions with directory services involve **checking information**, not changing it. For example:

* **Logging into your work computer**: The system reads your username and password from the directory to verify you .
* **Accessing a shared folder**: The directory checks if you have permission to view the files .
* **Connecting to Wi-Fi**: The network authenticates your device by reading its details from the directory.

These actions happen constantly in organizations, making **reads** much more frequent than **writes** (like updating a password or adding a new user).



## What is LookUp Request ?

> The term **"lookup requests"** refers to operations where a system searches for and retrieves specific information stored in a directory or database. In the context of directory services (like Active Directory or LDAP), a lookup request means asking the directory to find a particular unique entry, such as a user’s account details, a device name, or a domain name.

#### <mark style="color:blue;">Simple Explanation:</mark>

* Imagine a **phone book**: a lookup request is like looking up a person’s phone number by their name.
* You provide the directory with a key piece of information (like a username), and it returns the matching entry with all related details (like email, permissions,......).

#### <mark style="color:blue;">Technical Context:</mark>

* A lookup targets **one specific, unique entry** in the directory.
* It is different from a search, which might return multiple entries matching some criteria.
* Lookup requests are very common in directory services because systems constantly need to verify user identities, permissions, or resource locations by quickly retrieving precise information.



***

References : [https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ldap/what-is-a-directory-service](https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ldap/what-is-a-directory-service)

***



