Ask HN: LDAP as a service

6 points by traxtech 11 years ago | 10 comments

Hi. I'm contemplating the idea of a Saas business, a LDAP as a service : a LDAP server and a web interface for account admin and users self servicing (password update/reset with tfa, account editing, org chart viewing, directory index..)

The idea it to help medium sized orgs to centralize credentials for third party solutions (like every oss project with LDAP integration) and reap the benefits : better security, less admin tasks, etc. It won't be something like a captive portal, or a complete SSO solution.

Each customer would get its own VPS instance with the solution deployed on it (LDAP server, web server..), for $149/m.

Suggestions ?

SEJeff 11 years ago |

Medium sized orgs that want LDAP (and might not have the necessary Linux / Unix skills) just use Active Directory. Also, if you don't wrap it in Kerberos, it might be difficult to gain adoption. I say this as someone considering themselves a LDAP SME having setup multimaster openldap with 68 slaves globally using delta syncrepl

Good luck!

traxtech 11 years ago | |

Orgs do really expose their Active Directory server on the internet, to integrate with external servers ?

SEJeff 11 years ago | | |

Not entirely sure of your question. I'd think exposing your ldap service to the open internet is asking for very very bad things to happen.

I'd expect a service like this would use Amazon VPC, a secure VPN to access it, or something like that. What kind of data do you envision being stored in this directory, user credentials, or other things?

At $last_job, I was on a mission to put everything in LDAP. There is a custom OpenLDAP schema that the gnome.org sysadmin team (which I am an alumni member of) which allowed users to put in their ssh pub key via a webui. Hosts then run a cronjob every XX time period that put those ssh keys down (in a root owned directory/file so users can't change them), and was pretty slick. I also put DNS zone info and sudoers information into LDAP, as I already had a badass distributed datastore, ldap :)

That being said, can you come up with a real use case where your service makes sense? Active Directory is hard to compete against, it is super cheap and a pretty solid kerberized ldap for SMBs.

hyc_symas 11 years ago | | |

Most orgs put an OpenLDAP proxy in front of their AD server. AD has multiple known crash vulnerabilities in its protocol parser (fuzzing attacks can easily break it) and is too slow to handle the load generated from open internet access.

SEJeff 11 years ago |

HN won't let me respond to your last comment, but I think that's a reasonable plan. Using LDAP directly over the internet in general sounds like a bit of a risky proposition. Perhaps do both that and SAML, then you make everyone happy. Again, good luck, I hope I was able to help you firm up your ideas.

traxtech 11 years ago | |

I digged some docs, I think I'll do LDAP+web for user self-servicing+SAML with Shibboleth+maybe OpenID. That will complicate the automated customer setup, but it'll cover many use cases.

Thanks for the help!