4 ms·
> doesn't work well with password managers, how to new team members learn the password, no easy way to rotate passwords when offboarding This is where LDAP and
by foepys 5y ago
> doesn't work well with password managers, how to new team members learn the password, no easy way to rotate passwords when offboarding
This is where LDAP and similar are really strong. Unfortunately a lot of companies know that and charge big bucks for this simple feature, often hiding it behind "enterprise" subscriptions where you need to contact them for pricing.
It's also the reason why companies love Exchange and the rest of Microsoft's ecosystem.
- loevborg 5y agoThat's the thing though - I don't want the complexity of Exchange, LDAP, etc. Complexity kills. This is a simple problem calling for a straightforward solution.
- VTimofeenko 5y agoTechnically as far as I understand the client side certificates and signing/revoking them through internal CA solve the same problems. However I have yet to encounter such setup used in a professional environment for humans. Is the complexity of such approach just too high compared to LDAP and the passwords?
- throwawayboise 5y agoNormal users (including some people with graduate degrees in computer science) can't manage client-side keys or certificates, as anyone who has ever had to support users using ssh key authentication knows. So then you have to provide functionality to do this for them in a foolproof and secure way, which is a big bite to chew.
- VTimofeenko 5y agoYeah, I figured the end-user support would fall under the abstract "complexity" I mentioned in my original comment. I can build a hotrod in my garage but nobody sane will use it for public transportation.