389 Directory Server

389 Directory Server
Name	389 Directory Server
Developer	Fedora Project, Red Hat
Released	2001
Programming language	C, Python
Operating system	Red Hat Enterprise Linux, Fedora, CentOS, Debian, Ubuntu
License	GNU Lesser General Public License

389 Directory Server is an open-source LDAP server originally developed by the University of Michigan and later maintained by projects associated with Red Hat and the Fedora Project. It provides a standards-compliant Lightweight Directory Access Protocol implementation used for directory services in enterprise identity and access scenarios involving products such as FreeIPA, SSSD, Microsoft Active Directory, OpenLDAP, and Samba. The server has been adopted in deployments alongside technologies like Kerberos, DNS, NTP, and configuration tools such as Ansible, Puppet, and SaltStack.

History

The project traces its lineage to directory work at the University of Michigan and enterprise products from companies like Netscape Communications Corporation and Netscape Directory Server. Development stewardship transitioned through organizations including Red Hat and contributors from the Fedora Project, with community participation from vendors such as IBM, Oracle Corporation, and integrators familiar with SUSE and Debian. Milestones align with standards bodies like the IETF and the publication of LDAP-related RFCs, while the codebase evolved in parallel with directory-oriented deployments in environments run by NASA, US Department of Defense, and large telcos.

Architecture and Components

The server implements LDAPv3 and integrates with directory-related protocols and systems including Simple Authentication and Security Layer, Transport Layer Security, and replication systems comparable to those used by Microsoft Active Directory. Key components include a core directory engine written in C, a management console and tooling implemented with Python and command-line utilities, administrative interfaces compatible with Cockpit Project and web-based management stacks, and a back-end that stores entries in a database storage layer comparable in role to Berkeley DB or LMDB-style engines. Replication, suffix management, plugin frameworks, and overlays enable integration with identity management systems such as FreeIPA, Red Hat Identity Management, and authentication brokers like Centrify.

Features

Feature sets cover LDAP operations, schema management, access control, and extensibility used by solutions like Keycloak, OCSP, and enterprise identity products from Ping Identity and Okta. The server supports multi-master replication, chrooted operation on platforms such as Red Hat Enterprise Linux, LDAP over TLS (LDAPS), StartTLS, and referral handling compatible with Active Directory Federation Services designs. Administrative features include role-based access, fine-grained access control instructions resembling XACML patterns, auditing to integrate with auditd and SIEMs like Splunk, and plug-in authentication modules that work with Kerberos and PAM stacks common on Ubuntu and CentOS.

Deployment and Configuration

Deployments span single-server, high-availability clusters, and geographically distributed multi-master topologies used by organizations such as Intel Corporation, Cisco Systems, and public sector entities. Configuration management integrates with Ansible, Chef, Puppet, and orchestration platforms like Kubernetes for containerized deployments, while packaging and system integration target distributions including Fedora, CentOS Stream, AlmaLinux, and SUSE Linux Enterprise Server. Administrators often model directory trees influenced by identity schemas from eduPerson and integrate with provisioning tools such as SCIM-based systems, HR systems from Workday, and enterprise directories like Oracle Directory Server.

Security and Authentication

Security is implemented via TLS, StartTLS, SASL mechanisms including GSSAPI for Kerberos interoperability, and password storage techniques compatible with SSHA, bcrypt, and enterprise credential vaults like HashiCorp Vault. Access control uses ACLs and overlays supporting delegated administrative models similar to Role-Based Access Control approaches used in Microsoft Azure Active Directory. Integration with directory synchronization tools and audit pipelines enables compliance with standards and frameworks such as ISO/IEC 27001 and regulatory regimes encountered by organizations like European Commission agencies and financial institutions including JPMorgan Chase.

Performance and Scalability

Performance characteristics emphasize indexing strategies, cache tuning, and replication topologies that scale to millions of entries in deployments seen at large research facilities such as CERN and enterprise customers like Oracle Corporation and IBM. Benchmarking and capacity planning reference workload simulators from the OpenLDAP community and common performance tools like JMeter and sysbench, while operational scaling leverages sharding patterns, referral chaining, and read-write separation comparable to approaches used by Microsoft Exchange and large-scale directory services at cloud providers such as Amazon Web Services and Google Cloud Platform.

Community and Development

Development is coordinated through project infrastructure associated with the Fedora Project and hosted in version control systems used by contributors from Red Hat, independent consultants, and academic collaborators. The community collaborates with standards organizations like the IETF, participates in conferences such as FOSDEM and Red Hat Summit, and engages with adjacent open-source projects including Samba, OpenLDAP, FreeIPA, and MIT Kerberos. Contributions follow licensing and governance norms consistent with the GNU Project and open-source foundations, with packaging maintained across distributions including Debian and Ubuntu.

Category:Directory services Category:Free software programmed in C