License & Deployment Mix: 14 tools – 4 OSS, 7 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
Overview
Directory services platforms provide integrated identity, authentication, and policy management for enterprise environments. Unlike raw LDAP servers (see LDAP Servers), these platforms combine a directory backend with Kerberos authentication, DNS integration, group policy enforcement, and domain-join capabilities.
Key Capabilities
- Domain controller – central authority for domain membership, computer accounts, and trust relationships
- Kerberos KDC – ticket-based authentication for single sign-on across domain resources
- LDAP directory – hierarchical user, group, and organisational unit storage
- DNS integration – service discovery records (SRV, PTR) for domain resources
- Group Policy – centralised configuration management for domain-joined machines
- Domain join – Windows, macOS, and Linux clients joining the domain for SSO
- Certificate services – PKI/CA for domain certificate issuance and management
- Replication – multi-site directory and authentication replication
- Trust relationships – cross-domain and cross-forest authentication trusts
Evaluation Criteria
- Domain capabilities – domain join, GPO, Kerberos, DNS integration
- OS support – Windows, Linux, macOS client domain join
- Replication – multi-site, multi-master, geographic distribution
- Policy engine – Group Policy, HBAC, sudo rules, conditional access
- PKI integration – built-in CA, certificate management
- Cloud hybrid – sync with cloud directories (Entra ID, Google, etc.)
- Self-hosted option – on-premises deployment
- Administration – web UI, CLI, PowerShell, API
- Pricing – OSS vs licensed; per-user or per-server models
Category Boundaries
- LDAP servers (OpenLDAP, 389 DS standalone) are in LDAP Servers
- IdP / SSO platforms (Authentik, Keycloak) are in IAM & Identity Governance (IGA)
- IGA / governance (SailPoint, MidPoint) are in IAM & Identity Governance (IGA)
- Products like FreeIPA and JumpCloud span multiple categories and are cross-referenced
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
For domain-level services (domain join, Kerberos, Group Policy), FreeIPA and Samba AD DC are the primary OSS candidates. AD DS may be required for environments with existing Windows infrastructure, and cloud directories (Entra ID, JumpCloud) serve cloud-first deployments.
Deployment Model
| Tool | License | Self-Hosted | SaaS | Docker |
|---|---|---|---|---|
| AD DS | Proprietary | Yes | No | No |
| FreeIPA | GPL-3.0 | Yes | No | Yes |
| Samba AD | GPL-3.0 | Yes | No | Yes |
| Univention | AGPL-3.0 | Yes | Yes | Yes |
| Zentyal | GPL-2.0 | Yes | No | No |
| Entra ID | Proprietary | No | Yes | N/A |
| JumpCloud | Proprietary | No | Yes | N/A |
| Google Cloud ID | Proprietary | No | Yes | N/A |
| AWS DS | Proprietary | No | Yes | N/A |
| Foxpass | Proprietary | No | Yes | N/A |
| Okta UD | Proprietary | No | Yes | N/A |
| OneLogin | Proprietary | No | Yes | N/A |
| Ping Identity | Proprietary | Yes | Yes | Yes |
| Oracle IDM | Proprietary | Yes | Yes | Yes |
Domain Controller Capabilities
| Tool | Domain Join | Kerberos | DNS | GPO |
|---|---|---|---|---|
| AD DS | Win/Mac/Linux | Yes | Integrated | Full |
| FreeIPA | Linux/Mac | Yes | BIND | HBAC/sudo |
| Samba AD | Win/Mac/Linux | Yes | BIND DLZ | Partial |
| Univention | Win/Mac/Linux | Yes | BIND | Samba GPO |
| Zentyal | Win/Mac/Linux | Yes | BIND | Samba GPO |
| Entra ID | Entra Join | No* | N/A | Intune |
| JumpCloud | Win/Mac/Linux | No | N/A | Policies |
| Google Cloud ID | ChromeOS | No | N/A | Policies |
| AWS DS | Win/Linux | Yes | Yes | Full (AD) |
| Foxpass | Linux | No | N/A | No |
| Okta UD | No | No | N/A | No |
| OneLogin | No | No | N/A | No |
| Ping Identity | No | No | N/A | No |
| Oracle IDM | No | No | N/A | No |
*Entra ID uses OIDC/OAuth tokens instead of Kerberos tickets; Kerberos available through Entra Domain Services (managed AD DS on Azure).
Best domain controller: AD DS (full GPO, all OS), FreeIPA (Linux-first, HBAC), Samba AD (AD-compatible on Linux).
Client OS Support
| Tool | Windows | Linux | macOS | ChromeOS |
|---|---|---|---|---|
| AD DS | Native | SSSD/realm | MCX | No |
| FreeIPA | Limited | SSSD | SSSD | No |
| Samba AD | Native | SSSD/realm | MCX | No |
| Univention | Native | SSSD | MCX | No |
| Zentyal | Native | SSSD | MCX | No |
| Entra ID | Entra Join | No | No | No |
| JumpCloud | Agent | Agent | Agent | No |
| Google Cloud ID | No | No | No | Native |
| AWS DS | Native | SSSD | No | No |
| Foxpass | No | SSH keys | No | No |
| Okta UD | SSO only | SSO only | SSO only | SSO |
| OneLogin | Desktop SSO | No | Desktop SSO | No |
| Ping Identity | SSO only | SSO only | SSO only | No |
| Oracle IDM | SSO only | SSO only | SSO only | No |
Best cross-OS: JumpCloud (agents for all 3), AD DS/Samba AD/Univention (native Windows + SSSD Linux + MCX macOS).
Authentication & Trust
| Tool | Kerberos | LDAP | NTLM | AD Trust | MFA |
|---|---|---|---|---|---|
| AD DS | Yes | Yes | Yes | Native | 3rd party |
| FreeIPA | MIT KDC | 389 DS | No | Cross-realm | OTP |
| Samba AD | Heimdal | Internal | Yes | Limited | No |
| Univention | Samba | OpenLDAP | Yes | Samba | No |
| Zentyal | Samba | Samba | Yes | Samba | No |
| Entra ID | Via DS* | No | No | Entra Connect | Yes |
| JumpCloud | No | Yes | No | No | Yes |
| Google Cloud ID | No | Via GCDS | No | No | Yes |
| AWS DS | Yes | Yes | Yes | AD trust | MFA |
| Foxpass | No | Yes | No | No | Yes |
| Okta UD | No | Via agent | No | No | Yes |
| OneLogin | No | Via sync | No | No | Yes |
| Ping Identity | No | PingDir | No | No | Yes |
| Oracle IDM | No | OUD | No | No | Yes |
*Entra Domain Services provides managed AD DS with Kerberos on Azure.
FreeIPA supports cross-realm Kerberos trust with AD DS, enabling Linux/UNIX SSO alongside Windows AD domains.
PKI & Certificate Services
| Tool | Built-in CA | Cert Mgmt | Let’s Encrypt |
|---|---|---|---|
| AD DS | AD CS | Yes | No |
| FreeIPA | Dogtag CA | Yes | Certbot |
| Samba AD | No | No | No |
| Univention | UCS CA | Yes | Yes |
| Zentyal | No | No | No |
| Entra ID | No | No | N/A |
| JumpCloud | No | No | N/A |
| Google Cloud ID | No | No | N/A |
| AWS DS | No | ACM | ACM |
| Foxpass | No | No | N/A |
| Okta UD | No | No | N/A |
| OneLogin | No | No | N/A |
| Ping Identity | No | No | No |
| Oracle IDM | No | OIM | No |
Best PKI: AD DS + AD CS (Windows ecosystem), FreeIPA + Dogtag (Linux ecosystem with automatic cert renewal via certmonger).
SSO / OIDC Detail
| Tool | SAML | OIDC | SCIM | RADIUS |
|---|---|---|---|---|
| AD DS | Via ADFS | Via ADFS | No | NPS |
| FreeIPA | No | No | No | Yes |
| Samba AD | No | No | No | No |
| Univention | SAML | OIDC | No | RADIUS |
| Zentyal | No | No | No | No |
| Entra ID | Yes | Yes | Yes | No |
| JumpCloud | Yes | Yes | Yes | Yes |
| Google Cloud ID | Yes | Yes | Yes | No |
| AWS DS | Via IAM | Via IAM | No | No |
| Foxpass | No | No | No | Yes |
| Okta UD | Yes | Yes | Yes | No |
| OneLogin | Yes | Yes | Yes | No |
| Ping Identity | Yes | Yes | Yes | No |
| Oracle IDM | Yes | Yes | Yes | No |
On-premises directory services (AD DS, FreeIPA, Samba AD) handle Kerberos/LDAP authentication; SAML/OIDC requires an IdP layer (ADFS, Authentik, Keycloak). Cloud directories natively support modern SSO protocols.
Pricing
| Tool | Model | Free Tier | Starting Price |
|---|---|---|---|
| AD DS | Windows Server | No | CAL-based |
| FreeIPA | Self-hosted | Yes (GPL) | Free |
| Samba AD | Self-hosted | Yes (GPL) | Free |
| Univention | Self/SaaS | Yes (Core) | Free / custom |
| Zentyal | Self-hosted | Yes (Community) | EUR 195/srv |
| Entra ID | Per user | Yes (Free) | $6/user/mo |
| JumpCloud | Per user | Yes (10 users) | $9/user/mo |
| Google Cloud ID | Per user | Yes (Free) | $7.20/user/mo |
| AWS DS | Per hour | No | ~$0.05/hr/DC |
| Foxpass | Per user | No | Custom |
| Okta UD | Per user | No | $2/user/mo |
| OneLogin | Per user | No | Custom |
| Ping Identity | Enterprise | No | Custom |
| Oracle IDM | Enterprise | No | Custom |
Best value OSS: FreeIPA (full-featured Linux domain, GPL), Samba AD (AD-compatible, GPL). Univention Core Edition is free for internal use. AD DS requires Windows Server CALs.
Recommendation Summary
| Segment | Recommended | Rationale |
|---|---|---|
| Windows domain | AD DS | Native GPO, full Windows |
| Linux domain | FreeIPA | HBAC, sudo, Dogtag CA |
| AD-compat on Linux | Samba AD | Windows join, GPO |
| SMB all-in-one | Univention | Web UI, app centre |
| Cloud-first | Entra ID | M365, conditional access |
| Cross-OS cloud | JumpCloud | Agent for all OSes |
| Google ecosystem | Google Cloud ID | Workspace tie-in |
| AWS workloads | AWS DS | Managed AD on AWS |
| Infrastructure auth | Foxpass | LDAP + RADIUS + SSH |
| SaaS IAM | Okta UD | 7000+ app integrations |
Tools
14 tools.
AWS Directory Service
AWS Directory Service provides managed directory solutions within the AWS cloud. The primary offering is AWS Managed Microsoft AD, which runs actual Microsoft Active Directory Domain Services managed by AWS.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Foxpass
Foxpass is a cloud-hosted directory service focused on providing LDAP, RADIUS, and SSH public key management without requiring organisations to deploy and manage their own directory servers.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
FreeIPA / Red Hat Identity Management
FreeIPA is a Linux-centric identity management system that bundles 389 Directory Server, MIT Kerberos KDC, BIND DNS, and Dogtag PKI into a unified platform with a web UI and CLI.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
Google Cloud Identity
Google Cloud Identity is Google’s cloud-based directory and identity management platform, providing user and group management, SAML/OIDC SSO, MFA, device management, and a Secure LDAP service.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
JumpCloud Open Directory Platform
JumpCloud is a cloud-based directory platform that combines user directory, SSO, MFA, device management (MDM), LDAP-as-a-Service, and RADIUS-as-a-Service into a single SaaS product.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC
Microsoft Active Directory Domain Services
Active Directory Domain Services (AD DS) is Microsoft’s enterprise directory service, introduced with Windows 2000 and now the dominant identity platform in corporate environments.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Microsoft Entra ID
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management platform. It serves as the identity backbone for Microsoft 365, Azure, and thousands of SaaS applications.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Okta Universal Directory
Okta Universal Directory is the cloud directory underlying the Okta identity platform, unifying user profiles from multiple sources with SSO, MFA, SCIM provisioning, and AD/LDAP integration.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
OneLogin (One Identity by Quest)
OneLogin is a cloud-based identity and access management platform providing SSO, MFA, cloud directory, and user provisioning. Originally an independent company, OneLogin was acquired by One Identity (a Quest Software division) in 2021.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Oracle Identity Management
Oracle Identity Management is Oracle’s comprehensive IAM suite providing directory services, access management, identity governance, and provisioning.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
Ping Identity (Thales)
Ping Identity is an enterprise identity platform providing SSO federation, API security, directory services, and cloud identity management.
License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none
Samba AD DC
Samba AD DC is an open-source implementation of Microsoft’s Active Directory Domain Controller protocol.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
Univention Corporate Server (UCS)
Univention Corporate Server (UCS) is a Debian-based Linux platform that integrates Samba AD, OpenLDAP, and a web-based management portal into a turnkey domain controller and application server.
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: none
Zentyal
Zentyal is an Ubuntu-based small business server designed as a drop-in replacement for Microsoft Windows Small Business Server.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none
