Wren:DS

Wren:DS is an open-source directory services from the Wren Security suite. Built on the Java platform, Wren:DS provides a robust, standards-compliant LDAP directory server designed to store, manage, and serve identity data at scale.

Wren:DS is commonly deployed as the identity data backbone when requiring a standards-compliant directory. Its replication engine and fine-grained access control make it suitable for both greenfield deployments and migrations from commercial directory products.

Core capabilities include:

• LDAPv3 compliance — full support for the LDAP protocol including search, compare, modify, add, delete, and extended operations; LDIF import and export
• High availability replication — multi-master replication across geographically distributed data centers with automatic conflict resolution and fractional replication for bandwidth-constrained links
• High performance — tunable caching, indexing, and entry compression; handles millions of entries and thousands of operations per second
• Security — TLS/SSL for all connections; SASL authentication mechanisms including PLAIN, CRAM-MD5, DIGEST-MD5, GSSAPI; password storage using industry-standard hashing algorithms with salting
• Fine-grained access control — LDAP-based ACI model with support for bind-rule conditions on IP, DNS, authentication method, time, and user attributes; global ACIs and per-entry overrides
• Password policies — configurable per-subtree policies controlling complexity, history, lockout, expiry, and grace login behaviour
• DSML/REST gateway — HTTP-based REST and DSML interfaces for consuming directory data from applications that cannot use native LDAP
• Schema management — standard and custom schema extensions; online schema updates without server restart
• Monitoring and alerting — JMX, SNMP, and built-in cn=monitor backend; alerting via SMTP and SNMP traps; detailed operational statistics per connection handler and backend
• Administration tools — command-line tools (dsconfig, ldapmodify, ldapsearch, manage-tasks) and a web-based control panel for day-to-day operations

Wren:DS scales from a single-node deployment storing tens of thousands of user entries to a globally distributed, multi-master topology serving hundreds of millions of directory objects with low read latency.