1. A computer-implemented method comprising: storing, in an LDAP directory having a root node, in a first directory subtree that descends from the root node, identities of entities that are associated with a first identity domain but not with a second identity domain; storing, in the LDAP directory, in a second directory subtree that also descends from the root node but is separate from the first directory subtree, identities of entities that are associated with the second identity domain but not with the first identity domain; preventing service instances that have been deployed to the first identity domain from accessing identities that are stored in the second directory subtree; and preventing service instances that have been deployed to the second identity domain from accessing identities that are stored in the first directory subtree.