Directory Service Authentication
Directory Service (DS) authentication is Layer 1 — the foundation of every authentication scheme in Thinfinity® Workspace. Regardless of whether additional layers such as Identity Provider (IdP) mapping, Single Sign-On (SSO), or Multi-Factor Authentication (MFA) are configured later, every user session ultimately resolves to an identity within a configured Directory Service.
For a conceptual overview of each Directory Service type, see Directory Services and Identity Providers in the Identity Management section.
This article explains how the login process works at this foundational layer: what happens when a user enters credentials, how those credentials are validated, and which Directory Service types are available for different deployment scenarios.
How Thinfinity Workspace Uses Directory Service Login
When a user accesses Thinfinity Workspace and submits their credentials on the login page, the platform initiates a validation process:
- The user enters the credentials on the Thinfinity Workspace login page.
- The Primary Broker receives the credentials and determines which Directory Service should handle validation, based on the configured providers and the format of the username.
- The Directory Service validates the credentials against its identity store — whether that is the local SAM database, an Active Directory domain controller, a remote domain via the AD Cache (RemoteAD), or Thinfinity’s internal user store.
- If validation succeeds, Thinfinity Workspace establishes a session and grants access according to the permissions assigned to that user within the platform.
- If validation fails, the login page displays an error message indicating the nature of the failure (invalid credentials, expired password, account locked, etc.).
Multiple Directory Services can be active simultaneously. When more than one Directory Service is enabled, the platform resolves the appropriate provider based on the username format (e.g., DOMAIN\user or user@domain.com).
Choosing a Directory Service
| Scenario | Recommended DS | Reason |
|---|---|---|
| Quick setup / standalone server | Local Computer Users | Works out of the box, no configuration needed. |
| Server joined to AD domain | Local Computer Users or Computer Domain | Winlogon handles domain authentication natively. |
| Thinfinity Workspace + on-premises AD | External Domain (RemoteAD) | Bridges networks without domain trusts or VPN. |
| No AD / small team | Thinfinity IdP | Self-contained, no external dependencies. |
| Multi-domain enterprise | Trusted domains or Multiple External Domains | With trusts, one AD Cache serves all the domains; without trusts, each domain gets its own AD Cache connector. See Configuring AD Cache for Multiple Domains. |
Directory Services define who can authenticate. To control what they can access after login, configure permissions through Access Profiles, Labels, and User Interface Permissions. See the Access Management section for details.
Configuring Directory Services
Directory Services are managed from Config Manager > Authentication > Directory Services. From this tab you can add, enable/disable, reorder, and configure each Directory Service.
Adding a Directory Service
Select +Add to see the available types:
| Type | When to add | Notes |
|---|---|---|
| Local Computer Users | Default — present at installation | Created automatically. No configuration needed. |
| Computer Domain | Broker server is joined to an AD domain | Only available when domain membership is detected. |
| External Domain (RemoteAD) | Workspace is not joined to the target domain | Requires an AD Cache (RemoteAD) service running in the target domain. |
| Thinfinity IdP | No external directory infrastructure available | Only one instance allowed. |
In the Directory Services section of Thinfinity Configuration Manager, each method — Local Computer Users and Thinfinity IdP — may only be listed once. Conversely, Computer Domain and External Domain entries can be added multiple times to support multi-domain configurations.
What Comes Next
Directory Service login is the starting point. From here, you can add additional authentication layers:
- SSO with External Identity Providers: Delegate authentication to an external provider (Azure AD, Google, Okta) and enable streamlined login while keeping authorization in Thinfinity Workspace.
- Multi-Factor Authentication: Add a second verification step on top of any login method.
- Passkeys (WebAuthn): Replace passwords entirely with phishing-resistant cryptographic credentials.
See the Authentication Schemes overview for guidance on combining layers based on your security requirements.