Design an Employee Directory Service (LDAP/Active Directory)

To design an Employee Directory Service, I first clarify that we need to support millions of users with sub-second read latency while ensuring strong consistency for permission changes. I would start by defining a schema where Users are nodes linked to Groups and Roles via a many-to-many relationship, storing attributes in a columnar store for fast filtering. For the architecture, I'd propose a read-replica pattern where the primary database handles writes from HR systems, while multiple read replicas serve queries globally. To handle synchronization with on-premise Active Directory, I'd implement a Change Data Capture pipeline that listens to AD event logs, queues changes in Kafka, and applies them asynchronously to our cloud service, ensuring eventual consistency without blocking user logins. Security is paramount; I'd enforce Role-Based Access Control (RBAC) at the API gateway level, ensuring employees only see data relevant to their department. Given Salesforce's focus on trust, I'd also include audit logging for every permission change and encrypt sensitive fields like SSNs at rest. Finally, I'd add a caching layer using Redis for frequently accessed profile data to reduce database load during peak login times.