KuppingerCole Report

EXECUTIVE VIEW

By Martin Kuppinger
September 15, 2020

Atos DirX Directory
Atos DirX Directory is one of the few enterprise-grade directory services in
the market, delivering a high-performance, high-scalability, high-availability,and high-secure implementation that is required by many of today’s largescale use cases in the Digital Transformation. Atos DirX Directory builds on apurpose-built and optimized data layer and delivers comprehensive support
for X.500 and LDAPv3 protocols and specifications.
By Martin Kuppinger
mk@kuppingercole.com

Content
1 Introduction .................................................... 3
2 Product Description .............................................. 5
3 Strengths and Challenges ......................................... 84 Related Research ............................................... 10
Content of Figures............................................... 11

Copyright ...................................................... 12

KuppingerCole Executive View
Atos DirX Directory
Report No.: ev80421
Page 2 of 12

1 Introduction

IAM (Identity & Access Management) today is at the core of enterprise IT infrastructures when it comes toprotecting digital corporate assets. IAM, as the name states, is about managing identities and their access.
This involves managing user accounts and their entitlements across the variety of systems and applicationsin use in organizations.
Directory Services are where IAM started, and directory services are ubiquitous today. However, many
directory services are widely transparent, being an integral part of cloud services such as Access
Management solutions delivered as IDaaS (Identity as a Service). On the other hand, some directories suchas Microsoft Active Directory or Microsoft Azure Active Directory come as part of other services, withMicrosoft Azure Active Directory also offering commercial options for certain large-scale use cases.
Amongst the various flavors of directory services, the traditional high-end, stand-alone directory servers
have lost some of the attention they’ve gained in the past, where such directories were the foundation forboth corporate directory services and the customer directories. However, there is still a need for directory
services that can act as back-end, specifically around high-end use cases. Such scenarios aren’t rare at all,despite the lack of a hype. They include, amongst others

Customer directories for Telco services
Citizen and patient directories in Healthcare services
Customer directories in B2C use cases
Digital services involving customers and IoT devices, such as around the connected car
As part of the Digital Transformation, creating digital services involving millions of users, devices, and things
has become the new normal for many businesses. These digital services require a strong identity backend,
including directory services that can scale, that are highly performant, and that are extremely robust.
Factually, KuppingerCole expects seeing an uptake of strategic investments in high-end directory services
in the context of new Digital Transformation use cases.
We expect seeing many of the digital service implementations of today struggling with limitations of thedirectory services – frequently as integral part of IDaaS offerings, where only some provide extreme
scalability, performance, and reliability – and thus shifting to specialized directory backends in future.
Thus, while attention on this type of solutions is low in the market, there are use cases and indicators for an
uptake of this market segment. From our perspective, there are various use cases, scenarios, andarchitectural approaches that make use of enterprise-grade directory services not only an option, but while
significantly benefit from these.
One of the vendors in that space is Atos. Atos is the largest European IT service provider and amongst theglobal top 5 players for digital services. As part of their portfolio, Atos delivers various IAM services andKuppingerCole Executive View
Atos DirX Directory
Report No.: ev80421
Page 3 of 12

products. Amongst these, there are the DirX products, including DirX Directory as an enterprise-grade, highend directory server, delivered by the Evidian business unit of Atos.

KuppingerCole Executive View
Atos DirX Directory
Report No.: ev80421
Page 4 of 12

2 Product Description

Evidian, part of Atos, provides DirX Directory (currently in version 8.9) as a high-end directory server,delivering full LDAPv3 and X.500 functionality. It builds on a specialized database kernel, which is named
DBAM (Directory Basic Access Method), that is optimized solely for the purpose of such directory service
and provides extensive caching including in-memory database features. In contrast to various otherspecialized Directory Services, DirX Directory does not utilize a standard RDBMS (Relational Database
Management System) or other standard components.
Being an LDAP/X.500 Directory Service, the data model, schema, and administration model as well as theprotocols for interfacing with DirX Directory are targeted on this established concept for directory services.
Access protocols include

LDAP (Lightweight Directory Access Protocol)
DAP (Directory Access Protocol, X.500)
DSP (Directory System Protocol for communication between Directory Service Agents)
DISP (Directory Information Shadowing Protocol for data replication)
IDM (Internet Directly Mapped Protocol for mapping of X.500 protocols to TCP/IP)
While these protocols deliver a comprehensive implementation of both LDAPv3 and X.500, there are no outof-the-box REST APIs or other modern protocols available, which would simplify utilizing DirX Directory bydevelopers of modern digital services. Despite the performance loss by utilizing such protocols, Evidian
would be well-advised in adding such a layer. However, Atos has already put a RESTful API for DirX
Directory on the roadmap.
The LDAP/X.500 focus of DirX Directory also involves a consequent implementation of the respective
schema. DirX Directory supports all standards and specifics of these schemas, that are – again –constructed for high-performance/high-scalability implementations. However, there are limitations regarding
the flexibility of such services when it comes to extensions beyond the traditional scope of users and theirattributes, specifically for new use cases in building digital services. This can, as the variety ofimplementations of DirX Directory proves (e.g. including healthcare and public sector digitization and IoTrelated use cases), be well-addressed within the capabilities of DirX Directory, but requires well-thought-out
architectures and concepts. On the other hand, the balance between flexibility and optimization is always
about making decisions – and DirX Directory is consequently optimized for large-scale use cases.

KuppingerCole Executive View
Atos DirX Directory
Report No.: ev80421
Page 5 of 12

Figure 1: DirX Directory areas of application (Source: Atos, reproduced with permission by Atos).

Furthermore, DirX Directory comes with enhancements that e.g. support very large groups, nested groups,
and dynamic groups, as well as optimizations for dealing with recurring attribute values.
DirX Directory works with DSAs (Directory Service Agents) as the components that interface to thedatabase kernel. Commonly, there are multiple DSAs in an implementation, and very frequently, such DSAs
run in a geographically dispersed environment.
The implementation of the DSAs delivers the foundation for high-performance access, but also highavailability configurations. DirX Directory e.g. supports shadow DSAs that take over the role of a master
DSA in case of failures of the previous master DSA. This is also called “floating master”. Failover can beconfigured and automated, and synchronization between DSAs can happen synchronous andasynchronous, but also media-based for setting up new DSAs with offline transport of the DSA data.
A relatively new capability is the integrated LDAP Proxy, which allows for routing LDAP requests to target
LDAP servers, based on rules. These rules can be based on user attributes such as UPNs (User PrincipalNames), but also on operational aspects. Again, load-balancing and fail-over are supported for the LDAP
proxy. Besides the routing feature the LDAP Proxy provides an extensive rewriting of schema and attributeinformation to provide e.g. schema compatibility.
Another important capability of DirX Directory is the full transaction support including rollback andconsistency checks for all operations that modify data in the directory services.
Due to the maturity of DirX Directory and the variety of use cases supported, many of these in criticalindustries, it comes to no surprise that the product provides a range of specific security features. Theseinclude various protocols for authentication of users, a flexible and granular access control model, encrypted
passwords, X.509 PKI support, password policies, and comprehensive auditing capabilities. Part of thesecurity features are flexible backup services that allow for full and differential backup without service
disruption.

KuppingerCole Executive View
Atos DirX Directory
Report No.: ev80421
Page 6 of 12

Administration of DirX Directory lacks a modern, web-based UI. The standard graphical UI is Java-based,
allowing for full control of the DirX Directory infrastructure. Beyond that, LDAP, RPC, and LDIF (LDAP DataInterchange Format) are supported as well, many of these protocols being common for automation of themanagement of an enterprise directory services infrastructure.
In sum, DirX Directory is one of the few enterprise-grade, stand-alone offerings in the market for Directory
Services. While Evidian positions the solution for all levels, from workgroup to enterprise to service
providers, we see the main use cases in enterprise solutions including support for new, large-scale digital
services, and in service provider implementations.

KuppingerCole Executive View
Atos DirX Directory
Report No.: ev80421
Page 7 of 12

3 Strengths and Challenges

DirX Directory counts amongst the leading-edge directory services in the market. It is a very mature product,
benefiting from continuous enhancements and innovations. It is proven in very large scale implementations
and comes with a wide range of capabilities around security, failover, high availability, and highperformance.
The architecture and technical implementation are well-thought-out, based on the long-standing experienceof Evidian in this market segment. However, some customers might miss more flexible schema
management beyond the LDAP/X.500 focus and a set of REST APIs for interfacing to DirX Directory. On theother hand, with DirX Directory being the backend of digital services, such interfaces can be easily added incustom implementations, abstracting the directory from the application layer. That also allows – as proven in
many implementations – for efficiently dealing with the schema specifics of LDAP/X.500.
The user interface is focused on enterprise-grade administration and automation, but may benefit from anadditional, web-based UI as it is common today.
In sum, DirX Directory clearly counts amongst the leading-edge offerings in the market segment ofenterprise-grade directory servers. Thus, it is an option that should be evaluated when businesses,
governmental organizations, and service providers require highly performant, scalable and reliable directory
services as backend for the digital services they are creating. While stand-alone directory servers aren’t thecommon choice of today, there are clear benefits of utilizing such services in well-thought-out, advanced
architectures.

KuppingerCole Executive View
Atos DirX Directory
Report No.: ev80421
Page 8 of 12

Strengths
Proven implementation of an enterprise-grade directory service.
Full support for X.500 and LDAPv3 standards.
Extremely high scalability and optimized for performance.
Various approaches for failover and high availability supported.
Integrates an LDAP Proxy services.
Builds on a specialized database kernel, optimized for directory services.
Strong security and auditing features.

Challenges
Lack of a set of REST APIs.
Reliance on LDAPv3/X.500 models might impose some limitations for flexible data models.
Administrative UI not supporting modern web-based interfaces yet.

KuppingerCole Executive View
Atos DirX Directory
Report No.: ev80421
Page 9 of 12

4 Related Research

Executive View: Atos DirX Access – 80167
Executive View: Atos DirX Identity - 80166
Executive View: Evidian Identity & Access Manager - 70871
Leadership Brief: 10 Top Trends in IAM – 80335

KuppingerCole Executive View
Atos DirX Directory
Report No.: ev80421
Page 10 of 12

Content of Figures
Figure 1: DirX Directory areas of application (Source: Atos, reproduced with permission by Atos).

KuppingerCole Executive View
Atos DirX Directory
Report No.: ev80421
Page 11 of 12

Copyright©2020 KuppingerCole Analysts AG all rights reserved. Reproduction and distribution of this publication in
any form is forbidden unless prior written permission. All conclusions, recommendations and predictions inthis document represent KuppingerCole´s initial view. Through gathering more information and performing
deep analysis, positions presented in this document will be subject to refinements or even major changes.
KuppingerCole disclaim all warranties as to the completeness, accuracy and/or adequacy of thisinformation. Even if KuppingerCole research documents may discuss legal issues related to information
security and technology, KuppingerCole do not provide any legal services or advice and its publications
shall not be used as such. KuppingerCole shall have no liability for errors or inadequacies in the information
contained in this document. Any opinion expressed may be subject to change without notice. All product andcompany names are trademarksTM or registered® trademarks of their respective holders. Use of them does
not imply any affiliation with or endorsement by them.

KuppingerCole Analysts support IT professionals with outstanding expertise in defining IT strategies andin relevant decision-making processes. As a leading analyst ompany, KuppingerCole provides first-handvendor-neutral information. Our services allow you to feel comfortable and secure in taking decisions
essential to your business.
KuppingerCole, founded back in 2004, is a global, independent analyst organization headquartered inEurope. We specialize in providing vendor-neutral advice, expertise, thought leadership, and practicalrelevance in Cybersecurity, Digital Identity & IAM (Identity and Access Management), Cloud Risk andSecurity, and Artificial Intelligence, as well as for all technologies fostering Digital Transformation. We
support companies, corporate users, integrators and software manufacturers in meeting both tactical andstrategic challenges and make better decisions for the success of their business. Maintaining a balance
between immediate implementation and long-term viability is at the heart of our philosophy.

For further information, please contact clients@kuppingercole.com.

KuppingerCole Executive View
Atos DirX Directory
Report No.: ev80421
Page 12 of 12

Powered by TCPDF (www.tcpdf.org)