Tutorial 3.8: Directory Services and Identity Management

← Previous Tutorial (3.7) | Table of Contents | Unit Home | Next Tutorial (3.9) →

Table of Contents

Learning Objectives

After completing this tutorial, you should be able to:

Overview

In the previous tutorials, we have examined authentication mechanisms—passwords, MFA, biometrics—and authentication protocols like Kerberos. However, authentication does not occur in a vacuum. Behind every authentication event lies an identity—a digital representation of a user, service, or device—that must be stored, managed, and maintained over its lifecycle. This is the domain of directory services and identity management.

Directory services are the foundational infrastructure for identity and access management (IAM). They provide a centralized repository for storing identity information, organizational structure, and configuration data. They enable authentication, authorization, and federation by providing a reliable source of identity attributes. The most common directory service is the Lightweight Directory Access Protocol (LDAP), which has become the universal standard for accessing directory information. Microsoft's Active Directory (AD) is the dominant enterprise directory, built on LDAP and providing a comprehensive IAM platform for Windows-centric environments.

This tutorial provides a comprehensive exploration of directory services and identity management. We begin by defining directory services and their role in IAM. We examine the LDAP protocol in depth: its data model (entries, attributes, object classes), the directory information tree (DIT), and common operations (search, add, modify, delete). We also explore LDAP security, including authentication mechanisms and SSL/TLS.

We then turn to Microsoft Active Directory, the most widely deployed directory service in enterprise networks. We cover its architecture, including domains, forests, organizational units, and global catalog. We also discuss AD's integration with Kerberos, DNS, and Group Policy.

Beyond the directory itself, we explore identity repositories and data sources—the various databases and systems that hold identity attributes. We discuss the concept of a system of record and how identity data is synchronized and reconciled.

A major focus is user provisioning and lifecycle management. We examine the processes for creating, maintaining, and deactivating user accounts, including automated provisioning, self-service, and the importance of timely de-provisioning. We also cover identity governance and administration (IGA), which encompasses access certifications, segregation of duties (SoD), and compliance reporting.

Finally, we explore privileged identity management (PIM), the specialized management of administrative and service accounts. We discuss just-in-time (JIT) privilege elevation, session monitoring, and the security benefits of PIM.

The tutorial concludes with case studies illustrating real-world directory and identity management implementations, and a discussion of the integration of directory services with modern authentication and authorization standards (SAML, OAuth, OpenID Connect).

By the end of this tutorial, you will have a thorough understanding of directory services and identity management, enabling you to design, deploy, and operate identity infrastructures that support secure authentication and access control.

1. Introduction to Directory Services

1.1 What Is a Directory Service?

A directory service is a software system that stores, organizes, and provides access to information about resources in a network—users, computers, printers, applications, and other entities. It is a specialized database optimized for read-heavy, search-intensive operations, rather than transaction processing. Directory services provide a hierarchical, logical view of the network and its resources, enabling centralized management and administration.

Key functions of a directory service include:

1.2 Directory vs. Relational Database

While both directories and relational databases store structured data, they have different design goals:

1.3 Evolution of Directory Services

The concept of directory services originated with the OSI X.500 standard, which defined a distributed directory. X.500 was complex and heavyweight, leading to the development of the Lightweight Directory Access Protocol (LDAP) in the 1990s. LDAP simplified X.500 and became the de facto standard for directory access. Today, LDAP is the foundation for most directory services, including Microsoft Active Directory, OpenLDAP, and Oracle Directory Server.

Key Takeaway: Directory services provide a centralized, hierarchical, read-optimized repository for identity and resource information, forming the backbone of enterprise identity and access management.

2. LDAP – Lightweight Directory Access Protocol

2.1 What Is LDAP?

LDAP is a protocol for accessing and maintaining directory information. It is based on a client-server model, where an LDAP client connects to an LDAP server (directory server) to perform operations. LDAP is defined in a series of RFCs, most notably RFC 4510 (LDAP Technical Specification Road Map).

2.2 LDAP Data Model

The LDAP data model organizes information as a hierarchical tree of entries. Each entry consists of a set of attributes and has a distinguished name (DN) that uniquely identifies it within the tree. The tree is called the Directory Information Tree (DIT).

┌─────────────────────────────────────────────────────────────────────────────┐ │ LDAP DIRECTORY INFORMATION TREE (DIT) │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ dc=example, dc=com (root) │ │ ├── ou=Users │ │ │ ├── cn=John Doe │ │ │ │ ├── cn: John Doe │ │ │ │ ├── uid: jdoe │ │ │ │ ├── mail: john@example.com │ │ │ │ └── objectClass: inetOrgPerson │ │ │ ├── cn=Jane Smith │ │ │ │ ... │ │ │ └── ... │ │ ├── ou=Groups │ │ │ ├── cn=Administrators │ │ │ │ ├── member: cn=John Doe, ou=Users, dc=example, dc=com │ │ │ │ └── ... │ │ │ └── ... │ │ └── ou=Computers │ │ ├── cn=Server1 │ │ └── ... │ │ │ └─────────────────────────────────────────────────────────────────────────────┘

Figure 1: LDAP Directory Information Tree (DIT) example.

2.3 LDAP Operations

LDAP defines a set of operations for interacting with the directory:

LDAP search filters are powerful and flexible, using expressions like (&(objectClass=user)(mail=*)) to find users with email addresses.

2.4 LDAP Security

LDAP supports several authentication mechanisms:

For secure deployments, LDAPS or StartTLS should be used to protect credentials and data in transit. Additionally, access control mechanisms (ACLs) are used to restrict who can read or modify entries.

2.5 LDAP Directory Services

Several LDAP-based directory products are widely used:

Key Takeaway: LDAP is a mature, standardized protocol for accessing directory information. Its hierarchical data model and search capabilities make it ideal for identity storage and management.

3. Microsoft Active Directory

3.1 Overview

Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. It provides authentication, authorization, and directory services for Windows-based environments. AD is based on LDAP, but extends it with proprietary features such as the Global Catalog, Group Policy, and Kerberos integration.

3.2 AD Structure: Domains, Forests, OUs

3.3 Global Catalog

The Global Catalog (GC) is a distributed data repository that stores a partial replica of every object in the forest. It enables fast searches across the entire forest and is essential for locating resources and resolving user principal names (UPNs).

3.4 AD Integration with Kerberos and DNS

Active Directory uses Kerberos as its primary authentication protocol. The domain controller acts as the KDC. AD also relies on DNS for service location (SRV records) and name resolution. Group Policy allows administrators to centrally manage operating system and application settings.

3.5 AD Schema and Object Classes

AD has a flexible schema that defines the object classes and attributes. The schema can be extended to add custom classes and attributes (e.g., to support line-of-business applications). Common object classes include:

3.6 AD Security

AD security is based on:

Important: Active Directory is a critical infrastructure component. Its compromise can lead to complete control of the network. Security best practices include regular patching, monitoring for anomalies (e.g., unusual Kerberos ticket requests), and using Privileged Access Workstations (PAWs).

4. Identity Repositories and Data Sources

4.1 Systems of Record and Systems of Engagement

In identity management, a system of record is the authoritative source for identity data. It is the system where identity information is created and updated (e.g., an HR system for employee data). A system of engagement is a downstream system that uses identity data (e.g., a directory service, cloud application). Identity data flows from the system of record to systems of engagement via provisioning processes.

4.2 Common Identity Repositories

4.3 Data Synchronization and Reconciliation

Identity data must be synchronized between repositories to ensure consistency. Synchronization can be:

Standards like SCIM (System for Cross-domain Identity Management) automate provisioning and synchronization between cloud applications and identity providers.

5. User Provisioning and Lifecycle Management

5.1 Identity Lifecycle Stages

The identity lifecycle consists of several stages:

5.2 Automated Provisioning

Automated provisioning uses workflows triggered by HR events (e.g., new hire, transfer, termination). The identity management system creates, modifies, or deletes accounts in connected systems. Tools like Microsoft Identity Manager, SailPoint, and Okta Lifecycle Management support automated provisioning.

5.3 Self-Service and Password Management

Self-service capabilities allow users to:

Self-service reduces helpdesk costs and improves user satisfaction, but must be secured with strong authentication.

5.4 De-provisioning: Timely Account Removal

De-provisioning is critical to prevent orphaned accounts. Orphaned accounts—accounts that remain active after the user leaves or role changes—are a major security risk. Best practices:

Key Takeaway: User provisioning and lifecycle management ensure that identities are created, maintained, and removed in a timely manner. Automation and integration with HR systems are essential for security and operational efficiency.

6. Identity Governance and Administration (IGA)

6.1 What Is IGA?

Identity Governance and Administration (IGA) is the set of policies, processes, and technologies for managing digital identities and their access rights. IGA ensures that access is appropriate, compliant, and auditable. It includes:

6.2 Access Certifications

Access certification is a formal process where managers review and certify (approve or revoke) the access rights of their subordinates. This is often done on a periodic basis (e.g., quarterly). Access certifications help identify excessive privileges and orphaned accounts.

6.3 Segregation of Duties (SoD)

SoD policies ensure that no single user can perform conflicting or fraudulent actions. For example, a user should not be able to both create a vendor and approve payment to that vendor. SoD conflicts are identified by analyzing user role memberships and permissions.

6.4 Role Management

Roles are collections of permissions that represent a job function (e.g., "HR Manager," "IT Administrator"). Role management involves:

6.5 Compliance and Auditing

IGA systems generate reports for compliance frameworks like SOX, HIPAA, GDPR, and PCI-DSS. Audit trails track who accessed what, when, and why. This enables forensic analysis in case of a security incident.

7. Privileged Identity Management (PIM)

7.1 What Are Privileged Identities?

Privileged identities are accounts with elevated access, such as domain administrators, system administrators, and service accounts. Compromise of a privileged account can lead to catastrophic security breaches. Privileged Identity Management (PIM) is a set of practices to secure, monitor, and manage these accounts.

7.2 PIM Principles

7.3 PIM Tools and Techniques

Warning: Failure to properly manage privileged identities is one of the leading causes of data breaches. Organizations must implement PIM as a core security control.

8. Integration with Authentication and Authorization

8.1 Directory Services as Authentication Providers

Directory services provide the user credentials and attributes needed for authentication. For example:

8.2 Authorization and Attribute Stores

Directories store user attributes (department, role, group memberships) that are used for authorization decisions. For example, a web application might check if a user belongs to the "Administrators" group before granting access to an admin panel. Directories also store ACLs for resources (e.g., file shares).

8.3 Federation and Identity Providers

Modern identity management often uses directories as the backend for federation. For example:

8.4 Standards and Protocols

9. Case Studies

9.1 Case Study: Enterprise Active Directory Consolidation

Background: A multinational corporation with 80,000 employees had grown through acquisitions, resulting in multiple Active Directory forests and domains. This caused inconsistent identity data, complex administration, and security gaps.

Solution: The organization undertook a forest consolidation project:

Outcome: The consolidation reduced administrative overhead, improved security, and enabled global single sign-on. Access certifications became more effective, and orphaned accounts were eliminated.

9.2 Case Study: Cloud Identity Migration

Background: A mid-sized technology company with 2,500 employees decided to move from on-premises Active Directory to a cloud-first identity model using Azure AD and Okta.

Solution:

Outcome: The company achieved a modern, scalable identity infrastructure. User experience improved with SSO, and security was enhanced with MFA and conditional access. The transition was phased to minimize disruption.

10. Summary and Transition

This tutorial provided a comprehensive exploration of directory services and identity management. We defined directory services as the backbone of identity and access management, providing a centralized, hierarchical repository for identity information. We examined the LDAP protocol in detail, covering its data model, operations, security, and common implementations.

We then focused on Microsoft Active Directory, the dominant enterprise directory, discussing its structure (domains, forests, OUs), Global Catalog, and integration with Kerberos and DNS. We also explored identity repositories and data sources, emphasizing the concept of a system of record and the importance of synchronization.

User provisioning and lifecycle management were discussed in depth, including automated provisioning, self-service, and de-provisioning. Identity governance and administration (IGA) was presented as the framework for ensuring appropriate access through certifications, segregation of duties, and compliance reporting. Privileged identity management (PIM) was covered as a critical security domain, with principles of least privilege, just-in-time access, and session monitoring.

Finally, we discussed the integration of directory services with authentication and authorization, including federation and modern identity standards. The case studies illustrated real-world directory consolidation and cloud migration projects.

This tutorial has equipped you with a deep understanding of directory services and identity management, which are essential for operating secure, scalable, and compliant identity infrastructures. In the next tutorial, Tutorial 3.9, we will transition to Access Control Fundamentals, where we will explore the core concepts of subjects, objects, permissions, and security policies that underpin access control models.

Quiz

Answer the following questions to check your understanding. Click the "Answer" button to reveal the solution.

Q1. LDAP is based on which earlier standard?

Answer
B) LDAP was designed as a lightweight version of the OSI X.500 directory standard.

Q2. In LDAP, the unique name of an entry is called its:

Answer
B) The Distinguished Name uniquely identifies an entry in the DIT.

Q3. Which of the following is not a standard LDAP operation?

Answer
C) Merge is not a standard LDAP operation. LDAP has Add, Delete, Modify, and others.

Q4. In Active Directory, what is the top-level security boundary?

Answer
B) The forest is the top-level security boundary in Active Directory.

Q5. The Global Catalog in Active Directory stores:

Answer
B) The Global Catalog stores a partial replica of every object in the forest.

Q6. Which protocol is commonly used for automated provisioning of identities to cloud applications?

Answer
B) SCIM (System for Cross-domain Identity Management) is used for automated provisioning.

Q7. Identity Governance and Administration (IGA) includes all of the following except:

Answer
C) Password hashing is a security mechanism, not part of IGA. IGA focuses on governance and administration of access rights.

Q8. Which principle is central to Privileged Identity Management (PIM)?

Answer
B) Just-in-time access is a core PIM principle, granting privilege only when needed.

Q9. In LDAP, the Bind operation is used for:

Answer
B) Bind authenticates the client to establish a session.

Q10. An orphaned account is an account that:

Answer
B) Orphaned accounts are active accounts with no legitimate owner, posing a security risk.

Q11. LDAP over SSL/TLS is commonly referred to as:

Answer
A) LDAPS is LDAP over SSL/TLS, typically using port 636.

Q12. Which Microsoft service provides federated authentication using Active Directory as the identity store?

Answer
A) Active Directory Federation Services (AD FS) provides federated authentication.

Exercises

These exercises are designed to help you apply the concepts from this tutorial. Attempt each exercise before revealing the sample solution.

Exercise 3.8-1: LDAP Search Design

You are an administrator of an LDAP directory. Write an LDAP search filter and base DN to perform each of the following tasks:

  1. Find all users in the "ou=Employees" subtree whose email address ends with "@example.com".
  2. Find all groups that have "John Doe" as a member.
  3. Find all computer objects in the "ou=Computers" subtree that are running Windows Server.
  4. Find all inactive users (assume there is an attribute "status=inactive") in the entire directory.
Sample Solution
  1. Base DN: ou=Employees,dc=example,dc=com; Filter: (&(objectClass=person)(mail=*@example.com))
  2. Base DN: ou=Groups,dc=example,dc=com; Filter: (&(objectClass=group)(member=cn=John Doe,ou=Users,dc=example,dc=com))
  3. Base DN: ou=Computers,dc=example,dc=com; Filter: (&(objectClass=computer)(operatingSystem=Windows Server*))
  4. Base DN: dc=example,dc=com; Filter: (&(objectClass=person)(status=inactive))

Exercise 3.8-2: Identity Lifecycle Workflow

Design a user provisioning workflow for a new employee. Include steps for:

  1. Initial HR event trigger.
  2. Account creation in Active Directory and key applications.
  3. Role assignment and access granting.
  4. User notification and password setup.
  5. Manager approval (if required).
  6. How the workflow handles changes (e.g., role change) and termination.
Sample Solution

Workflow:

  • Step 1 – HR event: HR system creates a new record with employee details (name, department, manager, start date).
  • Step 2 – Automated account creation: Identity Management system receives event, creates user account in Active Directory with a temporary password, and creates accounts in required applications (e.g., email, collaboration, CRM) via SCIM or APIs.
  • Step 3 – Role assignment: Based on department and job code, the system assigns roles (e.g., "Finance User") which grant specific permissions.
  • Step 4 – Notification: User receives welcome email with instructions to log in and change password, and enroll in MFA.
  • Step 5 – Manager approval: Optional; manager may need to approve initial access (handled via an approval workflow).
  • Changes: Role change triggers access recertification and adjustment of permissions.
  • Termination: HR event triggers de-provisioning, which disables accounts immediately and revokes access.

Exercise 3.8-3: IGA Access Certification

You are tasked with designing an access certification campaign for 1,000 employees. Describe the process, including:

  1. How you will determine which users and which access rights to review.
  2. How reviewers will be assigned (e.g., managers, application owners).
  3. What actions reviewers can take (approve, revoke, comment).
  4. How you will handle escalations for unresolved certifications.
  5. How compliance reports will be generated.
Sample Solution
  • Scope: All active employees with access to sensitive systems (e.g., HR, finance, R&D). Access rights include role memberships, group memberships, and application permissions.
  • Reviewers: Each user's manager is responsible for their direct reports. For application-specific access, application owners are also reviewers.
  • Actions: Reviewers can approve (confirm access is correct), revoke (remove access), or request more information.
  • Escalations: If a reviewer does not act within the campaign period, an escalation to the reviewer's manager occurs. If still unresolved, it goes to compliance team.
  • Reports: The IGA system generates reports showing certification status, revoked access, and compliance metrics for auditors.

Exercise 3.8-4: Active Directory Security Assessment

You are asked to assess the security of an Active Directory environment. List at least five areas you would examine, and for each, explain what risks they pose and how to mitigate them.

Sample Solution
  • 1. Weak password policies: Risk: password guessing and brute-force. Mitigation: enforce strong password policies (length, complexity, history).
  • 2. Excessive administrative privileges: Risk: privilege escalation. Mitigation: implement least privilege, use PIM with JIT access, and separate administrative accounts.
  • 3. Unpatched domain controllers: Risk: exploits. Mitigation: regular patching and update management.
  • 4. Unsecured LDAP (no TLS): Risk: eavesdropping and credential theft. Mitigation: enforce LDAPS or StartTLS.
  • 5. Orphaned accounts: Risk: unauthorized access. Mitigation: automated de-provisioning and regular audits.
  • 6. Weak Kerberos encryption: Risk: use of RC4 (easier to crack). Mitigation: enforce AES encryption.

Exercise 3.8-5: PIM Implementation Plan

Outline a plan to implement Privileged Identity Management (PIM) for a medium-sized enterprise. Include:

  1. Identification of privileged accounts (administrators, service accounts).
  2. Just-in-time (JIT) elevation process.
  3. Session recording and monitoring.
  4. Approval workflows for privilege requests.
  5. Integration with existing identity management.
Sample Solution
  • Phase 1: Inventory all privileged accounts (domain admins, local admins, service accounts). Use AD queries and discovery tools.
  • Phase 2: Implement a PIM solution (e.g., Azure AD PIM, CyberArk). Define roles and permissions.
  • Phase 3: Set up JIT elevation: users request elevation for a role, specify reason and duration (e.g., 2 hours). Require manager approval.
  • Phase 4: Enable session recording for all privileged sessions. Use jump servers for isolation.
  • Phase 5: Integrate with SIEM for alerting on privileged activity.
  • Phase 6: Conduct user training and awareness.

Homework

These homework questions require deeper analysis, research, and application. Answer each question comprehensively.

Homework 3.8-1: LDAP vs. Active Directory Comparison

Write a 1,000–1,250 word analysis comparing LDAP (as a protocol) with Microsoft Active Directory. Discuss similarities, differences, and how AD extends LDAP. Include architecture, features, security, and typical use cases.

Sample Answer

LDAP vs. Active Directory

  • Similarities: AD is built on LDAP and uses LDAP as its primary access protocol. Both support hierarchical data organization, search, and authentication.
  • Differences: LDAP is a protocol specification, while AD is a product. AD adds many features: Kerberos integration, Group Policy, Global Catalog, replication topology, and support for Windows-specific extensions (PAC, SID history).
  • Architecture: AD uses domains, forests, and OUs, with multi-master replication. LDAP is protocol; servers can be configured in various topologies.
  • Security: AD provides integrated security with Kerberos, ACLs, and auditing. LDAP supports various authentication mechanisms, but security depends on implementation.
  • Use cases: LDAP is used in many environments (Linux/Unix, open source). AD is dominant in Windows environments.

Homework 3.8-2: Identity Governance Strategy

Develop an identity governance strategy for a regulated financial services company with 5,000 employees. Cover:

  1. Access certification process.
  2. Segregation of duties (SoD) rules and enforcement.
  3. Role management and role mining.
  4. Compliance with SOX and GDPR.
  5. How to handle privileged access governance.
Sample Answer

Identity Governance Strategy

  • Access certification: Quarterly campaigns for all employees. Managers review direct reports' access. Application owners review application-specific access. Automated reminders and escalations.
  • SoD: Define SoD conflicts (e.g., finance roles: user cannot be both initiate and approve payments). Enforce during role assignment and access requests. Use SoD violation reporting.
  • Role management: Define business roles with clear permissions. Use role mining to analyze existing access and propose role definitions. Keep role definitions up to date.
  • Compliance: Generate reports for SOX (access controls, segregation) and GDPR (data access, consent). Maintain audit trails of all governance actions.
  • Privileged access: Use PIM with JIT elevation for administrative roles. Privileged accounts require additional certification.

Homework 3.8-3: Cloud Identity Integration

Write a 750–1,000 word paper on integrating on-premises Active Directory with cloud identity providers (Azure AD, Okta). Discuss synchronization methods, hybrid identity scenarios, security considerations, and the benefits of cloud identity management.

Sample Answer

Integrating On-Premises AD with Cloud Identity

  • Approaches: Password hash sync, pass-through authentication, federated identity (AD FS).
  • Synchronization: Use Azure AD Connect to sync users, groups, and attributes. Manage hybrid join.
  • Benefits: Single sign-on, unified identity, conditional access, and lifecycle management.
  • Security: Ensure sync account has least privilege, monitor sync activity, protect cloud accounts with MFA.

Homework 3.8-4: Troubleshooting LDAP Issues

You are an administrator and users cannot authenticate via LDAP. Outline a systematic troubleshooting approach. List common LDAP authentication failures and their likely causes. Include tools (e.g., ldapsearch, Wireshark, event logs) and steps to verify connectivity, binding, and search.

Sample Answer

Troubleshooting LDAP Authentication

  • Step 1: Check network connectivity (ping, telnet to LDAP port 389 or 636).
  • Step 2: Use ldapsearch with simple bind to test authentication: ldapsearch -x -H ldap://server -D "cn=admin,dc=example,dc=com" -W.
  • Step 3: Check for certificate errors (for LDAPS/StartTLS).
  • Step 4: Verify the bind DN and password.
  • Step 5: Check ACLs on the directory to ensure the user has search access.
  • Step 6: Check server logs for error messages.
  • Common issues: Incorrect DN, wrong password, password expiry, locked account, network firewall blocking ports, TLS version mismatch.

Homework 3.8-5: Research Paper on Identity Management Trends

Write a 1,500–2,000 word research paper on emerging trends in identity management, such as:

Include analysis of how directory services are evolving to support these trends.

Sample Answer

Note: This is a research assignment. The sample answer below provides an outline.

Emerging Trends in Identity Management

  • Zero Trust identity: Continuous verification, micro-segmentation, and adaptive authentication. Directory services integrate with risk-based policies.
  • Passwordless authentication: FIDO2 eliminates passwords. Directories store public key credentials and manage recovery.
  • Decentralized identity: Self-sovereign identity (SSI) uses verifiable credentials. Directories may become credential registries.
  • Identity analytics: AI/ML for anomaly detection, access prediction, and risk scoring.

Summary

This tutorial provided a comprehensive exploration of directory services and identity management. We defined directory services as specialized databases for storing and organizing identity and resource information, optimized for fast searches. The LDAP protocol was examined in detail, including its data model (entries, attributes, DIT), operations, and security mechanisms.

Microsoft Active Directory was presented as the dominant enterprise directory, with its domain, forest, and OU structure, Global Catalog, and integration with Kerberos and DNS. We discussed identity repositories and the importance of a system of record for identity data, along with synchronization and reconciliation.

User provisioning and lifecycle management were covered, emphasizing automated provisioning, self-service, and the critical importance of timely de-provisioning to prevent orphaned accounts. Identity Governance and Administration (IGA) was introduced as the framework for ensuring appropriate access through certifications, segregation of duties, and compliance reporting. Privileged Identity Management (PIM) was discussed as a specialized area focusing on securing administrative and service accounts through least privilege, just-in-time access, and session monitoring.

Finally, we explored the integration of directory services with authentication and authorization mechanisms, including federation and modern identity standards like SAML, OAuth, and SCIM. The case studies illustrated real-world directory consolidation and cloud migration projects.

This tutorial has provided you with a deep understanding of directory services and identity management, which are essential for operating secure, scalable, and compliant identity infrastructures. In the next tutorial, Tutorial 3.9, we will transition to Access Control Fundamentals, where we will explore the core concepts of subjects, objects, permissions, and security policies that underpin access control models.

← Previous Tutorial (3.7) | Table of Contents | Unit Home | Next Tutorial (3.9) →

© 2026 COMP400 – Computer and Network Security • School of Computing and Information Systems, TrustOpen University • Unit 3: Authentication and Access Control