Single Directory Ambitions
Somehow my old RSS reader missed a whole series of Radovan SemanÄÃk’s posts. (On an aside completely unrelated to the topic of this blog, NewsFire for the Mac is grand.) I came across a great entry Radovan made from back in May describing some of the reasons why organizations will be hard pressed to merge onto just one directory server and also some interesting points on why a directory server is not an authentication server. (Gratuitous marketing plug warning.) We put a lot of effort into the multi-directory connectivity and attribute mapping capabilities of our Ignition platform here at Identity Engines. It is nice to see some more evidence on the outside that this was time well spent.
In my customer interactions I see some of what Radovan posted but also see a common business reason for multi-directory: the rate of mergers and acquisitions in large enterprises today is high. As new organizations are integrated into the IT fabric of the acquiring entity, there is often a reasonably lengthy period where the directories remain disjointed. By planning your directory infrastructure and related AAA functions around the assumption that you will always have more than one directory it can lead you down a network architecture path that is significantly more flexible over the long term.