X.500
The OSI directory standard, defines a comprehensive directory service, including an information model, a namespace, a functional model, and an authentication framework. X.500 also defines the Directory
Access Protocol (DAP) used by clients to access the directory. DAP is a full OSI proto-col that contains extensive functionality, much of which is not used by most applications.
X.500 security features allow strong authentication using public key cryptosystems and access control to information on various level including administrator area, entry, attribute and attribute value. All aspect of an organization security policy should be easily configurable on each of its DSAs either through the use of a specialized tool or through simple editing of plain text configuration
LDAP
LDAP assumes the same information model and namespace as X.500. It is also client-server based, with one important difference there are no referrals returned in LDAP. An LDAP server must return only results or errors to a client. If referrals are involved, the LDAP server is responsible for chasing them down. This model is depicted in Figure 2, though the intermediate server shown is not required (i.e., an implementation could choose to have its DSA speak “native” LDAP).
LDAP offers security features that are not available in X.500. For example, LDAP offers confidentiality and runs over secure sockets layer (SSL) and X.500 does not. Also, LDAP supports multiple directory services and allows
URLs to be used in directory lookups, which X.500 does not do. X.500 though is still more advanced when it comes to server to server protocols and specifies a standard access control scheme, both of which LDAP cannot currently match.
Microsoft’s Active Directory
Active Directory is Microsoft's trademarked directory service, an integral part of the Windows 2000 architecture. Like other directory services, such as Novell Directory Services (NDS), Active Directory is a centralized and standardized system that automates network management of user data, security, and distributed resources, and enables interoperation with other directories. Active Directory is designed especially for distributed networking environments.
Active Directory features include:
- Support for the X.500 standard for global directories
- The capability for secure extension of network operations to the Web
- A hierarchical organization that provides a single point of access for system administration (management of user accounts, clients, servers, and applications, for example) to reduce redundancy and errors
- An object-oriented storage organization, which allows easier access to information
- Support for the Lightweight Directory Access Protocol (LDAP) to enable inter-directory operability
- Designed to be both backward compatible and forward compatible
