LinuxCon North America

Transcription

1 LinuxCon North America Enterprise Identity Management with Open Source Tools Dmitri Pal Sr. Engineering Manager Red Hat, Inc

2 Context What is identity management? 2 LinuxCon North America

3 Context What is identity management? Identity management (IdM) describes the management of individual principals, their authentication, authorization, and privileges within or across system and enterprise boundaries with the goal of increasing security and productivity while decreasing cost, downtime and repetitive tasks. Wikipedia 3 LinuxCon North America

4 IdM Related Technologies Active Directory LDAP Main identity management solution deployed in more than 90% of the enterprises... OpenLDAP 389 (RHDS) OpenDS ApacheDS SunDS edirectory 4 LinuxCon North America

5 IdM Related Technologies (cont) Kerberos Samba NIS MIT implementation Heimdal implementation An open source clone of Active Directory A file server (Samba FS) A client component to join Active Directory (winbind) 5 LinuxCon North America

6 IdM Related Technologies (cont) Web related technologies OpenID OAuth SAML WS-... Strong authentication Smart cards One Time Passwords (OTP) 6 LinuxCon North America

7 Active Directory vs. Open Source Why is Active Directory so popular? It is an integrated solution It is relatively easy to use Offers a simple configuration for clients All the complexity is hidden from users and admins Has comprehensive interfaces 7 LinuxCon North America

8 Active Directory vs. Open Source (2) What about Open Source tools? Solve individual problems Bag of technologies lacking integration Hard to install and configure Too many options exposed, which to choose? Lack of good user interfaces Is the situation really that bad? 8 LinuxCon North America

9 Introducing FreeIPA IPA stands for Identity, Policy, Audit So far we have focused on identities and related policies Main problems FreeIPA solves: Central management of authentication and identities for Linux clients better than stand - alone LDAP/Kerberos/NIS - based solutions Acts as a gateway between the Linux infrastructure and AD environment making infrastructure more manageable and more cost effective 9 LinuxCon North America

10 High Level Conceptual Architecture Unix/Linux PKI KDC DNS LDAP CLI/GUI Admin 10 LinuxCon North America

11 Features Centralized authentication via Kerberos or LDAP Identity management: Users, groups, hosts, host groups, netgroups, services Integrated identities Manageability: Simple installation scripts for server and client Rich CLI and web-based user interface Pluggable and extensible framework for UI/CLI Flexible delegation and administrative model 11 LinuxCon North America

12 Features (continued) Certificate provisioning for hosts and services Serving sets of automount maps to different clients Advanced features: Host-based access control Centrally-managed SUDO Group-based password policies Automatic management of private groups Can act as NIS server for legacy systems Painless password migration Managed hosts 12 LinuxCon North America

13 Features (continued) Optional integrated DNS server Replication: Supports multi-server deployment based on multimaster replication User replication with MS Active Directory Flexibility in deploying Certificate Authorities on different replicas Compatibility with a broad set of clients 13 LinuxCon North America

14 Introducing SSSD SSSD is a service used to retrieve information from a central identity management system. SSSD connects a Linux system to a central identity store like: Active Directory FreeIPA Any other directory server Provides authentication and access control 14 LinuxCon North America

15 Introducing SSSD (continued) Multiple parallel sources of identity and authentication domains All information is cached locally for offline use Remote data center use case Laptop or branch office system use case Advanced features for FreeIPA integration AD integration 15 LinuxCon North America

16 Identity Management Under the Hood NTP CA FreeIPA Core Kerberos KDC Directory Server DNS Management framework Authentication Users, Groups, Netgroups, HBAC Name lookups and service discovery Cert tracking & provisioning Other maps SSSD Certmonger Enrollment & un-enrollment Managed host (client) Management Station CLI Configures Configures ipa-client nss_ldap Management WEBUI Browser 16 LinuxCon North America

17 Identity Management Under the Hood FreeIPA Core Kerberos KDC Directory Server 17 LinuxCon North America

18 Identity Management Under the Hood FreeIPA Core Kerberos KDC Authentication Users, Groups, Netgroups, HBAC SSSD Managed host (client) Directory Server 18 LinuxCon North America

19 Identity Management Under the Hood FreeIPA Core Kerberos KDC Authentication Users, Groups, Netgroups, HBAC SSSD Managed host (client) Directory Server Other maps nss_ldap 19 LinuxCon North America

20 Identity Management Under the Hood NTP FreeIPA Core Kerberos KDC Authentication Users, Groups, Netgroups, HBAC SSSD Managed host (client) Directory Server Other maps nss_ldap 20 LinuxCon North America

21 Identity Management Under the Hood NTP FreeIPA Core Kerberos KDC Directory Server Authentication Users, Groups, Netgroups, HBAC Name lookups and service discovery SSSD Managed host (client) DNS Other maps nss_ldap 21 LinuxCon North America

22 Identity Management Under the Hood NTP CA FreeIPA Core Kerberos KDC Directory Server Authentication Users, Groups, Netgroups, HBAC Name lookups and service discovery SSSD Managed host (client) DNS Other maps nss_ldap 22 LinuxCon North America

23 Identity Management Under the Hood NTP CA FreeIPA Core Kerberos KDC Directory Server Authentication Users, Groups, Netgroups, HBAC Name lookups and service discovery SSSD Managed host (client) DNS Other maps nss_ldap Management framework 23 LinuxCon North America

24 Identity Management Under the Hood NTP CA FreeIPA Core Kerberos KDC Directory Server Authentication Users, Groups, Netgroups, HBAC Name lookups and service discovery SSSD Managed host (client) DNS Other maps nss_ldap Management framework Management Station CLI Management WEBUI Browser 24 LinuxCon North America

25 Identity Management Under the Hood NTP CA FreeIPA Core Kerberos KDC Directory Server DNS Authentication Users, Groups, Netgroups, HBAC Name lookups and service discovery Cert tracking & provisioning Other maps SSSD Certmonger Managed host (client) nss_ldap Management framework Management Station CLI Management WEBUI Browser 25 LinuxCon North America

26 Identity Management Under the Hood NTP CA FreeIPA Core Kerberos KDC Directory Server DNS Management framework Authentication Users, Groups, Netgroups, HBAC Name lookups and service discovery Cert tracking & provisioning Other maps SSSD Certmonger Enrollment & un-enrollment Managed host (client) Management Station CLI Configures Configures ipa-client nss_ldap Management WEBUI Browser 26 LinuxCon North America

27 FreeIPA and Active Directory User and password synchronization Cross realm Kerberos trusts Users in AD domain can access resources in a FreeIPA domain and vice verse A lot of use cases addressed and need to be addressed in future Complexity of transitive domains 27 LinuxCon North America

28 FreeIPA and Web Technologies Green field not much has been done What can be done: FreeIPA as an OpenID provider Can be integrated with IdP to provide bridging between ESSO and identity federation via mod_auth_kerb 28 LinuxCon North America

29 FreeIPA and Strong Authentication OTP support was recently introduced in FreeIPA First ever solution to provide OTP based ESSO via Kerberos Features Proxy to external RADIUS server Support of the TOTP tokens 29 LinuxCon North America

30 FreeIPA Future More cross project integration Support of sophisticated AD integration use cases Polishing the OTP solution User certificate and smart card support Enhancements DHCP integration Big backlog of RFEs 30 LinuxCon North America

31 FreeIPA and SSSD Communities Open Friendly Responsive Welcoming Come join us! 31 LinuxCon North America

32 Resources FreeIPA Project wiki: Project trac: Code: Mailing lists: SSSD: Mailing lists: Certmonger: 32 LinuxCon North America

33 Questions? 33 LinuxCon North America