LinuxCon North America - events.static.linuxfound.org · 16 LinuxCon North America Identity Management Under the Hood FreeIPA Core Directory Server Kerberos KDC NTP DNS Management

LinuxCon North AmericaLinuxCon North America

Enterprise IdentityEnterprise IdentityManagement with OpenManagement with Open

Source ToolsSource Tools

Dmitri PalSr. Engineering Manager Red Hat, Inc.

09.16.2013

2 LinuxCon North America

Context

● What is identity management?


Context

● What is identity management?

“Identity management (IdM) describes the management of individual principals, their authentication, authorization, and privileges within or across system and enterprise boundaries with the goal of increasing security and productivity while decreasing cost, downtime and repetitive tasks.”

Wikipedia


IdM Related Technologies

● Active Directory● Main identity management solution deployed

in more than 90% of the enterprises

● LDAP● OpenLDAP● 389 (RHDS)● OpenDS● ApacheDS● SunDS● eDirectory● ...


IdM Related Technologies (cont)

● Kerberos● MIT implementation● Heimdal implementation

● Samba● An open source clone of Active Directory● A file server (Samba FS)● A client component to join Active Directory

(winbind)

● NIS


IdM Related Technologies (cont)

● Web related technologies● OpenID● OAuth● SAML● WS-...

● Strong authentication● Smart cards● One Time Passwords (OTP)


Active Directory vs. Open Source

● Why is Active Directory so popular?● It is an integrated solution● It is relatively easy to use● Offers a simple configuration for clients● All the complexity is hidden from users and

admins● Has comprehensive interfaces


Active Directory vs. Open Source (2)

● What about Open Source tools?● Solve individual problems● Bag of technologies lacking integration● Hard to install and configure● Too many options exposed, which to choose?● Lack of good user interfaces

Is the situation really that bad?


Introducing FreeIPA

● IPA stands for Identity, Policy, Audit● So far we have focused on identities and

related policies

● Main problems FreeIPA solves:● Central management of authentication and

identities for Linux clients better than stand - alone LDAP/Kerberos/NIS - based solutions

● Acts as a gateway between the Linux infrastructure and AD environment making infrastructure more manageable and more cost effective


High Level Conceptual Architecture

KDC

LDAP CLI/GUI

Unix/Linux

Admin

PKI

DNS


Features

● Centralized authentication via Kerberos or LDAP

● Identity management: ● Users, groups, hosts, host groups, netgroups,

services● Integrated identities

● Manageability:● Simple installation scripts for server and client● Rich CLI and web-based user interface● Pluggable and extensible framework for UI/CLI● Flexible delegation and administrative model


Features (continued)

● Certificate provisioning for hosts and services

● Serving sets of automount maps to different clients

● Advanced features:● Host-based access control● Centrally-managed SUDO● Group-based password policies● Automatic management of private groups● Can act as NIS server for legacy systems● Painless password migration● Managed hosts


Features (continued)

● Optional integrated DNS server

● Replication:● Supports multi-server deployment based on multi-

master replication● User replication with MS Active Directory● Flexibility in deploying Certificate Authorities on

different replicas● Compatibility with a broad set of clients


Introducing SSSD

● SSSD is a service used to retrieve information from a central identity management system.

● SSSD connects a Linux system to a central identity store like:

● Active Directory● FreeIPA● Any other directory server

● Provides authentication and access control


Introducing SSSD (continued)

● Multiple parallel sources of identity and authentication – domains

● All information is cached locally for offline use● Remote data center use case● Laptop or branch office system use case

● Advanced features for● FreeIPA integration● AD integration


Identity Management Under the HoodFreeIPA Core

DirectoryServer

KerberosKDCNTP

DNS

Managementframework

Managed host (client)

SSSD

Management Station

CLI

Browser

Certmonger

ipa-client

CAConfigures

Configures

nss_ldap

WEBUI

AuthenticationAuthentication

Name lookupsName lookupsand serviceand servicediscoverydiscovery

Cert tracking &Cert tracking &provisioningprovisioning

Other mapsOther maps

Enrollment & un-enrollment Enrollment & un-enrollment

ManagementManagement

Users, Groups, Users, Groups, Netgroups, HBACNetgroups, HBAC



DirectoryServer

KerberosKDC



DirectoryServer

KerberosKDC


SSSD





DirectoryServer

KerberosKDC


SSSD

nss_ldap






DirectoryServer

KerberosKDCNTP


SSSD

nss_ldap






DirectoryServer

KerberosKDCNTP

DNS


SSSD

nss_ldap







DirectoryServer

KerberosKDCNTP

DNS


SSSD

CA

nss_ldap







DirectoryServer

KerberosKDCNTP

DNS

Managementframework


SSSD

CA

nss_ldap







DirectoryServer

KerberosKDCNTP

DNS

Managementframework


SSSD

Management Station

CLI

Browser

CA

nss_ldap

WEBUI








DirectoryServer

KerberosKDCNTP

DNS

Managementframework


SSSD

Management Station

CLI

Browser

CertmongerCA

nss_ldap

WEBUI









DirectoryServer

KerberosKDCNTP

DNS

Managementframework


SSSD

Management Station

CLI

Browser

Certmonger

ipa-client

CAConfigures

Configures

nss_ldap

WEBUI





Enrollment & un-enrollment Enrollment & un-enrollment




FreeIPA and Active Directory

● User and password synchronization● Cross realm Kerberos trusts

● Users in AD domain can access resources in a FreeIPA domain and vice verse

● A lot of use cases addressed and need to be addressed in future

● Complexity of transitive domains


FreeIPA and Web Technologies

● Green field – not much has been done● What can be done:

● FreeIPA as an OpenID provider● Can be integrated with IdP to provide bridging

between ESSO and identity federation via mod_auth_kerb


FreeIPA and Strong Authentication

● OTP support was recently introduced in FreeIPA

● First ever solution to provide OTP based ESSO via Kerberos

● Features● Proxy to external RADIUS server● Support of the TOTP tokens


FreeIPA Future

● More cross project integration● Support of sophisticated AD integration use

cases● Polishing the OTP solution● User certificate and smart card support● Enhancements

● DHCP integration● Big backlog of RFEs


FreeIPA and SSSD Communities

● Open● Friendly● Responsive● Welcoming

Come join us!


Resources● FreeIPA

● Project wiki: www.freeipa.org

● Project trac: https://fedorahosted.org/freeipa/

● Code: http://git.fedorahosted.org/git/?p=freeipa.git

● Mailing lists:

– [email protected]



● SSSD: https://fedorahosted.org/sssd/

● Mailing lists:



● Certmonger: https://fedorahosted.org/certmonger/

http://www.freeipa.org/

https://fedorahosted.org/freeipa/

http://git.fedorahosted.org/git/?p=freeipa.git

mailto:[email protected]



https://fedorahosted.org/sssd/



https://fedorahosted.org/certmonger/


Questions?

Documents

LinuxCon North America - events.static.linuxfound.org · 16 LinuxCon North America Identity Management Under the Hood FreeIPA Core Directory Server Kerberos KDC NTP DNS Management