피드 구독

In my Identity Management and Application Integration blog post I talk about how applications can make the most of the identity ecosystem. For example, a number of applications have integrated Apache modules and SSSD to provide a more flexible authentication experience.  Despite this progress - some (people) remain unconvinced. They wonder why they should use Apache modules and SSSD in conjunction with, for example, Active Directory instead of using a simple LDAP configuration… essentially asking: why bother?

Let’s look at this scenario in greater detail.  If an application supports

direct LDAP configuration it might be good enough. Then again, is it?

Two reasons why a systems administrator might choose to use the LDAP configuration provided by an application:

  • It is simple - you enter LDAP connection data and you are done.
  • The application’s UI might provide assistance.

However, while SSSD involves a marginally more complex setup / configuration, using SSSD provides several benefits over a direct LDAP integration, namely:

  • Enterprise SSO - using Apache modules and SSSD one can enable Kerberos based authentication so that users who authenticated against Active Directory can access an application without being prompted (again) for their username and password.
  • Failover - a built-in LDAP solution usually does not have a built-in failover capability so if the connection to the central server is lost the application may fail to function properly. SSSD, on the other hand, will discover Active Directory servers and will use an explicit or DNS based failover mechanism (depending on its configuration) enabling an application to continue to function (even when the connection is lost).
  • Offline support - if and when the connection to the central server is lost an application can continue to operate if it has a cache; SSSD provides such cache while a simple LDAP solution usually does not.
  • Security - the security of the connection to the LDAP server is also very important. In the simple LDAP case, the connection requires a password that is stored in the application configuration files or in a database. This is not a best practice.  In fact, it is much safer to use Kerberos keytab to connect to the central servers. This is what SSSD and GSSproxy take care of in the proposed solution.
  • Domain awareness - an Active Directory environment usually consists of multiple different domains combined into one or more forests. Users might be in different parts of the forest or in different forests altogether. An SSSD based solution hides all of this complexity and allows users from different domains and forests to access an application.  This is not possible with a simple LDAP configuration.
  • Site awareness - Active Directory servers are usually bound to a specific location or datacenter. An SSSD based solution can pick the closest Active Directory server based on site affiliation. In the case of simple LDAP, there is usually just one server and no discovery or site affiliation. This becomes important when an application has multiple instances and there is a preference for the application to connect to the local identity servers instead of going over the wire to a completely different part of the world.
  • Load balancing - an argument can be made that a direct LDAP connection is easily load balanced. It can be, but with an SSSD based solution you do not need a load balancer. Its discovery and failover capabilities save you time and money in terms of configuring and supporting yet another piece of hardware.

Overall, external authentication based on Apache modules adds a lot of flexibility in authentication methods, supports complex domain infrastructures, has better security properties, and raises the resiliency of the application without requiring extra equipment.

Of course, nothing comes for free. Configuring external authentication requires a little bit more understanding of the configuration challenges than does a simple LDAP configuration. It also adds some complexity, but this complexity is well worth the (small amount of) extra effort.  With SSSD, you get installation and configuration tools like ipa-client-install and realmd that make configuration both simple and easy. You also have access to the installation scripts or Puppet modules provided by the applications. These conveniences make SSSD based integration a very smooth process and give you access to all of the rich features inherent to SSSD.

As always - if you have thoughts or questions - feel free to reach out using the comments section (below).


저자 소개

UI_Icon-Red_Hat-Close-A-Black-RGB

채널별 검색

automation icon

오토메이션

기술, 팀, 인프라를 위한 IT 자동화 최신 동향

AI icon

인공지능

고객이 어디서나 AI 워크로드를 실행할 수 있도록 지원하는 플랫폼 업데이트

open hybrid cloud icon

오픈 하이브리드 클라우드

하이브리드 클라우드로 더욱 유연한 미래를 구축하는 방법을 알아보세요

security icon

보안

환경과 기술 전반에 걸쳐 리스크를 감소하는 방법에 대한 최신 정보

edge icon

엣지 컴퓨팅

엣지에서의 운영을 단순화하는 플랫폼 업데이트

Infrastructure icon

인프라

세계적으로 인정받은 기업용 Linux 플랫폼에 대한 최신 정보

application development icon

애플리케이션

복잡한 애플리케이션에 대한 솔루션 더 보기

Original series icon

오리지널 쇼

엔터프라이즈 기술 분야의 제작자와 리더가 전하는 흥미로운 스토리