1. A computer-implemented method comprising: storing, by a processor on a non-transitory computer-readable storage medium, in an LDAP directory having a root node, in a first directory subtree that descends from the root node, identities of entities that are associated with a first identity domain but not with a second identity domain; storing, by a processor on a non-transitory computer-readable storage medium, in the LDAP directory, in a second directory subtree that also descends from the root node but is a separate from the first directory subtree, identities that are associated with the second identity domain but not with the first identity domain; preventing service instances that have been deployed to the first identity domain from accessing identities that are stored in the second directory subtree; and preventing service instances that have been deployed to the second identity domain from accessing identities that are stored in the first directory subtree.