ldap authentication - AAA 1

[ccnguy]

Hello,

I have a Netware NOS with AS/400, e-mail and numerous other applications that require a username and password. I am looking to compare products that would bring these different databases together so to have users just enter 1 username and password to authenticate for all apps. Can someone tell me what product or products they are currently using to accomplish this or would use to do this?

Thanks,
Carl

 

[ldap4u]

Hopefully this response isn't to generic - but I think you are talking about 2 different products.

A lot of LDAP servers would probably be able to service your needs for storing user credentials - you could check out:

http://www.hotldap.com/vendors/

to start looking at the different choices. I would assume you would need to give serious consideration to Novell's offering if your company is continuing with Netware in the future.

This would not, however, solve your issue of having users sign on one time - as single sign-on is a solution unto itself - with several vendors offering products with their own individual twist. An overview of SSO - albeit a tad dated can be found at:

http://www.intranetjournal.com/articles/200205/se_05_28_02a.html

This article lists most of the vendors with SSO offerings - but does not include some of the up and coming solutions such as Imprivata or Aventail.

Hope this helps ...

 

[ldap4u]

Actually this would be a much better place to find information about LDAP vendors ...

http://www.ldapguru.org/modules/mylinks/viewcat.php?cid=2

 

[bearon]

Hi Carl,

Not all your systems will allow you to redirect authentication requests to an LDAP repository. Hence, we had to take a look at password synchronization products that would like the name says synch a users password on different systems. We just did a proof of concept with Novell's SSO solution called SecureLogin. Its more of a smoke screen for the user and it involves alot of scripting that uses a screen scraping technique for all terminal based apps. We discarded this solution. You can find password synch solutions at the following sites and a good revues on the subject in the others.

http://www.blockade.com

http://www.courion.com

http://www.sans.org/rr/authentic/synch.php

http://www.infosecuritymag.com/2002/apr/passwordmgmt.shtml

http://www.infosecuritymag.com/2002/dec/Sect1.pdf

http://www.infosecuritymag.com/2002/apr/toc.shtml

Hope this helps,
Cheers
Ronald

 

[ldap4u]

Ronald is right - not all applications will allow a redirect to LDAP - and you may not want to spend a bunch of time migrating your existing applications to use LDAP authentication (in our case 200 apps).

We obtained a password synchronization product which came bundled with our provisioning solution to handle password synchronization - but found that this only cut our help desk calls in half - as many of the applications our users utilize lie outside of our control on external sites with partners ...

For that reason we have taken a long hard look at client-based SSO alternatives for these applications and web sites ... allowing us to possibly provide SSO to applications we don't own (like Yahoo - or even Tek-Tips )

 

[BRCKCC]

Have you looked at dirXML from Novell? They do a lot of synchronizing of different databases. It's a little pricey and takes some configuration, but it will do what you need, I think.