3 ms·
Our authority for authentication is Active Directory, it may sound very enterprise and not-hip but it's great because basically everything supports it. A user j
by lucaspiller 10y ago
Our authority for authentication is Active Directory, it may sound very enterprise and not-hip but it's great because basically everything supports it. A user just needs one password for all our systems - email, servers, laptops, internal applications.
For servers we use LDAP, so you just SSH to a machine and it creates an account if one doesn't exist. It authenticates against AD every time, so if an account is disabled there, their access to all servers is instantly revoked. You can still use SSH keys so you don't need your password every time.
Internal web applications (mainly Rails) are backed by LDAP too, but also support NTLM SSO for Windows uses (so they only need to enter their password once when they log-in to their machine). Not everyone uses Windows (or is part of the domain), so we use CAS on top of that to make switching between applications transparent for everyone.
We don't really use any external services that we need to share passwords for.
- mrweasel 10y agoWe pretty much just authenticate as much as possible via our Active Directory. It just works, pretty much every self hosted service we have can authenticate via LDAP. I assume that we could just run an OpenLDAP server or something, but Active Directory is the easiest way to get started with LDAP. One idea I've had, but never got around to is a OpenID/OAuth service that could authenticate users via the AD.
- cpitman 10y agoTake a look at the open source project Keycloak (http://www.keycloak.org/ http://www.keycloak.org/), it does exactly that and takes very little time to setup. The easy way is pretty much: 1. Run the docker container (https://hub.docker.com/r/jboss/keycloak/) 2. Login to the web console 3. Create a "Realm" 4. Go to "User Federation" and add a "LDAP" provider 5. Go to "Clients" and configure keycloak to handle OpenID/SAML for your app Disclaimer: I work for Red Hat, and Keycloak is one of our projects. If you want support, we recently released it as RH SSO.
- mrweasel 10y agoThat's sort of what I wanted, but on steroids :-) Seems a little overkill for my use case, but nice.
- buro9 10y ago> One idea I've had, but never got around to is a OpenID/OAuth service that could authenticate users via the AD. I've just implemented auth0 on a website that I run, solely because one of my sites/customers wanted to have the service I provide be available via single sign-on to their staff and their customers. They store all of their staff in Active Directory, and their users in an SAP store. auth0 gives me a simple OAuth API, and I just point to my customers' configured auth0 client, and they can configure their auth0 account to use Active Directory and SAP. I actually liked the integration, wasn't hard to achieve and solved a hard problem. Given that auth0 is free for up to 7k users signing in within a month, I may make this available to other customers.
- GordonS 10y agoI didn't think you got AD integration for free? I thought that was in their 'enterprise' plans?
- buro9 10y agoThat is in one of their paid plans. However my customer needs vary, some of them will be good with just the auth0 free plans, some will choose the paid plans... some do not need it at all. The one who did need it found the price well within their estimate for it (they had a figure in mind for paying for the feature to be added which amounts to about 3+ years of auth0 service).
- deleted 10y ago[deleted]
- rb12345 10y agoIt's worth noting that it's safer to use Kerberos for the actual authentication part over LDAP and/or NTLM. In the event of the servers being hacked, you avoid leaking your password (but may leak some form of ticket, of course). Using LDAP to store the account details and authorization data (so you can create user accounts at first login) is fine though.