Easily Managing User Accounts on Your Cloud Servers. How modern IT and ops teams leverage their existing LDAP/Active Directory for their IaaS

Transcription

1 Easily Managing User Accounts on Your Cloud Servers How modern IT and ops teams leverage their existing LDAP/Active Directory for their IaaS

2 How Did We Get Here? How the move to IaaS has created problems for traditional user management Organizations have traditionally leveraged Microsoft Active Directory (AD) or the Lightweight Directory Access Protocol (LDAP) for managing access to their on-premise server infrastructure. LDAP and AD manage things like who has access to what on an organization s infrastructure. All servers, including file and print servers, would be actual hardware units located on-premise within a server closet, or if the organization was large enough, they d have their own data center. It was generally straightforward to make LDAP and AD talk to their servers since everything was local or within the domain. In recent history, cloud infrastructure or infrastructure-as-a-service (IaaS) has started taking charge. The shift from on-premise servers to cloud-based infrastructures is changing the dynamics of managing user access. No longer are servers local to the network structure. In fact, these days there may not be any infrastructure on-premise at all, instead replaced with web-based hosting services like Amazon Web Services (AWS), Rackspace, SoftLayer or a similar cloud or hosting provider. This inherently creates significant problems for IT administrators. For example, they are faced with the decision to either choose to accept a significant security risk, taking on much more work in order to secure their infrastructure, or opt to spend a significant amount of money to purchase an enterprise identity management solution. 02

3 Traditional Solutions Don t Fix the Complex Problem Traditionally, IT admins have had some less than perfect solutions to this problem Manually managing cloud server accounts Many IT admins choose perhaps the simplest way out of this predicament manually create, manage, and delete users on their cloud servers. They ll be notified (generally via ) of who requires what access to the cloud servers and they will manually provision and manage those users on the cloud servers. This entails the following: Logging into the servers themselves Managing the user creation Account and user modifications Handling the termination process Communicating with the user (generally insecurely) As the number of servers and users grows, this tedious process presents some significant challenges around tracking access. Also, adding capabilities such as multi-factor authentication become problematic, as those solutions can be painful to configure on a case-by-case basis. Finally, when using AWS many IT admins simply leverage a simple ec2-user account for access largely because it s easier, and thereby lose any on-host auditing capability. 03

4 Leverage configuration management tools In recent years another user management paradigm has emerged leveraging configuration manage tools, such as Chef, Puppet, Ansible, Salt, CFEngine, or others to add and remove user accounts across servers en masse. With just a few users and very simplistic access rules (for example, all users have access to all servers), this can be a panacea. It s quick, easy, inexpensive, and reasonably maintainable. But smart admins know this isn t the right way to solve the problem. As organizations grow, they quickly hit a barrier and it can become maddeningly complex to manage large numbers of users with complex access rules, IT admins become burdened with the time-consuming task to update code every time access roles change, with no easy way to off-load what should be a purely administrative task to someone with less training. Expose LDAP or AD to the Internet Another option often considered by IT admins is to expose LDAP or AD to the Internet and let the servers talk directly to the user directory. Through additional security and configuration, the LDAP or AD servers can be locked to only talk to certain servers. Depending upon the network architecture and growth of servers this may or may not be an option. If it isn t, then the user directory store is available to be queried by anybody on the Internet. Stand-up an entirely new LDAP or AD instance in the cloud For some organizations, a viable option is to create another directory store. Generally this involves standing up a new instance of AD or LDAP in the cloud. This works well if the cloud setup is logically in a Virtual Local Area Network (VLAN) or equivalent enclave where the directory server can talk to each of the servers. Additionally, 04

5 the cloud directory store needs to be synchronized with the main user directory or manually updates. This creates an extra layer of work for IT admins, but does give them the ability to manage users for their cloud servers via either LDAP or AD. Stand-up an entirely new LDAP or AD instance in the cloud For some organizations, a viable option is to create another directory store. Generally this involves standing up a new instance of AD or LDAP in the cloud. This works well if the cloud setup is logically in a Virtual Local Area Network (VLAN) or equivalent enclave where the directory server can talk to each of the servers. Additionally, the cloud directory store needs to be synchronized with the main user directory or manually updates. This creates an extra layer of work for IT admins, but does give them the ability to manage users for their cloud servers via either LDAP or AD. Implement an enterprise identity management solution Other organizations choose to either leverage an existing enterprise-class identity management solution or purchase one to manage their cloud servers. Generally, this approach involves installing the solution on-premises, connecting it to the main directory store, and then installing agents on each device that needs management. Often, this is implemented with the help of the vendor s professional services. The benefit of this type of solution is that it can be leveraged for internal desktops and servers. Some solutions also include mobile device management capabilities. For management of cloud servers, agents are installed on those servers and those agents will talk back to the solution s server located on the customer s premises. A central console will let the admin track and manage users across all of the servers. While an excellent solution, this approach is too costly for most organizations leveraging the cloud today. 05

6 The Main Problem with Traditional Solutions Understanding the problem is the key to discovering new ideas. Here are 4 important problems: Only one directory of record It is critical for organizations to have only one source of truth for users on the network. As you can imagine, multiple directories or manual management can easily cause conflicts and issues. The manifestations of problems in this category can be catastrophic. Imagine what could happen if a terminated employee still had access to critical servers because there wasn t an in-sync directory of users to server access. The less catastrophic and more mundane consequences of multiple directories is a layer of additional work and complexity. As the organization grows, the complexity will increase. While maintaining multiple disparate directories is never a good idea, the practice has been driven by very real, and in some cases, seemingly insurmountable technical issues. LDAP does not by default share the same schema as AD, so extra efforts must be made to have Windows clients authenticate against LDAP. Making one directory drive an entire organization is not a trivial task, so many organizations opt for two directories, one AD (usually the primary directory, because of its superior management UI) to cover the Windows hosts, and a slave LDAP server to cover everything else. 06

7 Network configuration/security exposure The move to the cloud for many companies is an acknowledgement that networking and network related configuration aren t an effective use of their time. Unfortunately, exposing your directory store to the Internet or standing up an additional directory store in the cloud each come with network configuration requirements. You ll need to be careful to walk through the right access controls to make sure that all of your machines can talk to each other properly setting up the correct firewall configuration, ensuring proper routing, configuring any necessary VPN connections, and dealing with SSL certificates and configurations. While not impossible, it is an added task that most organizations moving to the cloud would rather avoid. Reliability issues A number of these solutions can have reliability issues. Manually managing user access is subject to human error. Did every person get the access that they needed or did they get too much access? Creating additional directory servers in the cloud starts a whole additional chain of work. Directory servers need to be highly available and downtime can mean your users can t do their work. Exposing your directory server to the Internet can invite attacks or cause it to be subject to Internet connectivity issues between your cloud servers and your directory store. You ll need to address those issues either through load balancing or increased capacity. 07

8 High Cost Traditional solutions to server directory problems are expensive for organizations, whether it be from a monetary standpoint, or a time and resources perspective. Any way you cut it, managing users across your organization is often not a core competency. It needs to be done well and securely, but the costs of having resources focus on this task versus core tasks can be expensive. 08

9 A Modern Ops Approach to this Problem Here s how innovative organizations are smartly and securely extending their AD and LDAP users stores to their IaaS The most efficient and complete way to tackle server access, privacy, and security issues is to fix a central user directory with either LDAP or AD internally. The directory store becomes the one directory of record. From this central directory, organizations create a bridge to their cloud server infrastructure. That infrastructure may be at one or a number of different IaaS players. Linux Innovative organizations will leverage a SaaS-based cloud user management service. Windows Because many servers are located remotely, LDAP/AD businesses need a simple way for each server to know who needs to have access to it. Efficient organizations will leverage a SaaS-based cloud user management service. The user management service will sync the users with the internal LDAP or AD directory. From there, a lightweight agent is generally employed on each server. In this way, the right users are provisioned and managed on each server virtually automatically. Bridge Organization prem Extending LDAP/AD to the Cloud SaaS user management service Public Cloud Private Cloud Colo 09

10 Cloud-based solutions solve the most complex problems No network configuration required Agents installed on each server send feedback securely to the cloud-based, SaaS user management service. The LDAP and AD agents manage all users, keeping them in sync without opening firewall ports or exposing your core directory to the Internet. Increased security With a cloud-based solution you don t have to expose your central directory to the Internet, and all of your users are continuously kept in sync. Additionally, you can be assured that user access to your server infrastructure is tightly controlled. The number one risk for any organization is from compromised user accounts and keeping only the right users on every machine is critical. Little to no additional administration Because your users are kept automatically in sync and your group tags are replicated to your cloud infrastructure, there is very little additional work to be done by IT admins. They are responsible for creating accounts and providing privileges once. From there, the system does the work of securely replicating that information and creating the right access. The cloud-based directory is the approach that modern organizations are employing to manage and secure access to their cloud server infrastructure. It s a vexing problem without the right approach, but by leveraging an elegant cloud-based, SaaS user management bridge, they can make quick work of this problem. 10

11 Looking for more Information? Find out more about what JumpCloud s Directory-as-a-Service can do for your company. Contact us For additional reading, blog updates, and the latest news please visit our blog. Read more about DaaS Benefits of Saas-Based LDAP Download the Guide Using Gmail? Still Have Active Directory? Learn How to Move AD to the Cloud. Download the Guide About JumpCloud: JumpCloud, the first Directory-as-a-Service (DaaS), is Active Directory and LDAP reimagined. JumpCloud securely connects and manages employees and their devices and IT applications. Try JumpCloud s cloud-based directory free at jumpcloud.com.