2 ms·
I call it a "domain controller" because it keeps a directory of users and hosts, accessible via LDAP. This source of truth drives the Certificate Authority rol
by elevation 2y ago
I call it a "domain controller" because it keeps a directory of users and hosts, accessible via LDAP. This source of truth drives the Certificate Authority role which can cryptographically assert authn/authz and distribute those assertions to member hosts in the form of certificates, password hashes, etc. A DC may also securely distribute time to its hosts, which is important for accurately calculating the validity of a certificate.
A classic DC would authenticate windows logins and rely on an external network. My design authenticates just TLS and web-app logins (not windows) but also provides an authenticated layer 3 network. So it's hardware-attested zero trust -- something that's difficult to securely assemble out of existing SaaS.
This would be overkill for a typical call center (large scale, high churn, low trust) but perfect for a team working on sensitive IP (smaller scale, low churn, high trust.) Research and development, administrating expensive systems (regional manufacturing?) or for collaborative work on sensitive documents (legal?)
- beardedwizard 2y agoIsn't this an idp? I'm totally unclear how this is differentiated from an idp that also requires a hardware key.
- elevation 2y agoIt _has_ an IdP, but you have to be authenticated at a lower layer in the stack before you can talk to it. Think Tailscale+Let's Encrypt+Okta but all in a single package.
- kchr 2y agoI guess it could be categorised as a PAM (privileged access management) solution with a built-in IdP?
- mrmetanoia 2y agoI was about to say this sounds like our on prem PAM setup which is integrated with our idp - or some mixture of things folks are asking about. Seems like this is something largely solved regardless of how it's being done, but maybe we're all missing something. Or maybe his implementation is just that slick.
- elevation 2y agoDoes your PAM include a data loss prevention feature?
- mrmetanoia 2y agoYes
- beardedwizard 2y agoBut that's just certificate auth, which happens during session establishment and before data transmission isn't it? So isn't it an idp with cert auth as the primary first factor?
- klaushardt 2y agoSo for example Shibboleth with privacyIDEA and enabled webAuthn and 2FA for AnyConnect or some other VPN?
- beardedwizard 2y agoThis is what I was thinking
- rblatz 2y agoLook into products like okta, they have similar functionality. They also sync data from AD. I'd focus on not providing the LDAP management, but instead syncing other LDAP sources in.