Setting up an Active Directory just for test users

The Problem:

Testing software that integrates with Active Directory, where attributes of the user influence how the software behaves. For example, if the user is inactive, locked, belongs to group 'x', or has some attribute 'y' with value 'z'.

There is a non-production instance of Active Directory that has a fixed number of test users defined. Those test users are shared by the whole company. This means a fair amount of limitations on what we can do without stepping on other team's toes.

The Need:

The ability to programmatically add a test user to the directory, perform my test, modify and re-test as needed, then programmatically remove the user when I'm done.

The Question:

Is there a tool that will let me manage my users programmatically, preferably via a RESTful interface?

• Best solution would be a directory (AD or LDAP or whatever) that can be instantiated in a Docker image, and will play well with other instances running at the same time somewhere on the network, and will be indistinguishable to the system under test

• Alternatively, provides a convenient API to manage an existing AD instance (the Test instance), which can be access-controlled using a separate AD instance (the Prod instance)

• Prefer a solution that does not assume an all-Microsoft ecosystem, as the test execution environment will usually be Java/Linux

All solutions welcome: pointers to how to do this using only Active Directory, the name of open-source tools that can stand in for AD and provide the requisite management API, third-party management interfaces for AD, etc.