By Rajat Bhargava Posted April 9, 2015
OpenLDAP™ is the open source leader in directory services. Based on LDAP (the widely used protocol), OpenLDAP has been used by organizations for almost two decades.
In that time, OpenLDAP had become the standard for technical organizations. Due to the limitations of Microsoft® Active Directory® , IT Departments conventionally turned to OpenLDAP for UNIX and Linux® based devices and more technical applications. Initially, the challenges of connecting *NIX devices to Microsoft Active Directory (AD) were practically insurmountable. Microsoft has since improved compatibility, but it still is more often the case that *NIX devices will be either connected to LDAP or not managed at all.
With more Linux devices in play each year, OpenLDAP has been rising in popularity. But there are a number of challenges with OpenLDAP as organizations consider whether or not to use it.
Top 5 OpenLDAP Challenges
OpenLDAP was created in an era where software was all housed on-premises. There was no concept of the cloud. Today, we know the cloud is the future. Organizations need to account for it and embrace it.
Leveraging OpenLDAP in the cloud creates a number of challenges for IT organizations. Cloud infrastructure, heterogeneous device environments, and tight device compliance requirements are all realities that place a great deal of pressure on OpenLDAP to perform in ways that it has not been designed to do. Here are five challenges to consider before taking the plunge with OpenLDAP:
(1) Setup and Configuration
As many users of open source know, open source software can be challenging to setup and configure. It is generally built by technical people for technical people.
Most IT admins just want to be consumers of OpenLDAP, not contributors. They are looking to leverage its capabilities and generally aren’t interested in managing schemas or adding and removing user and group objects. The time they spend setting up and configuring OpenLDAP is time away from their other priorities.
OpenLDAP is known to be complex to setup and configure. This is largely because of its extreme flexibility. So is there a way to leverage OpenLDAP functionality without the heavy lifting of setting up and configuring it?
The answer, is yes. Directory-as-a-Service® solutions are hosting LDAP for organizations. No longer do IT admins need to setup and configure LDAP. Through Directory-as-a-Service, IT admins can leverage a highly available, globally dispersed LDAP system.
(2) Connecting devices to LDAP
Linux devices are fairly easy to connect to LDAP. They’ve been set up to be seamlessly connected to LDAP.
Other platforms are not so easy. Take macOS® for example. To connect to LDAP requires upwards of 25 steps! To believe that end users will do that work is deluding yourself. It may be possible to script many parts of that process, but that will require coding which will take time, effort, and expertise.
Connecting other types of devices varies in level of difficulty, but the overarching point is that OpenLDAP works for certain devices and not others. If you happen to have the ‘others’, LDAP becomes a more challenging solution to put in place.
The alternative here is to leverage a hosted LDAP system that uses agents to connect all devices back to the central directory. Directory-as-a-Service platforms support Linux, macOS, and Windows.
(3) Connecting Applications to LDAP
Just like with devices, connecting applications to LDAP can be easy in some cases and extremely difficult in others.
LDAP can be connected to a wide variety of applications. The challenge is how to connect the application properly. The first step is establishing the port and protocol. Then, you’ll need to configure a number of settings to properly access the LDAP database. This requires that the user who is accessing the database has the proper authorization and that authorization is passed to LDAP properly. In order to search the database, you’ll also need to configure the application properly. This is often referred to as the base DN.
In order to make this process easier, the LDAP platform needs to leverage standardization. JumpCloud’s Directory-as-a-Service solution enables IT admins to quickly and easily connect applications to their hosted LDAP platform.
(4) Web-based applications
Organizations are using more web-based applications than ever before. The benefits are easy to understand. No on-premise hardware, software, and little management are huge perks for IT organizations.
Many web-based applications don’t talk LDAP, but rather they authenticate via SAML. SAML has become the authentication and authorization standard of choice for SaaS-based applications.
As a result, connecting those applications back to an OpenLDAP implementation becomes difficult. Most organizations will seek out a ‘translation’ service which has become known in the industry as Single Sign-on solutions (SSO). The SSO provider will sync with OpenLDAP and then translate those identities into ones that are consumed by the web applications.
A central, cloud-based directory service can be leveraged to connect to SSO solutions or directly to Web applications.
(5) System management
With a cross-platform environment, a critical task for any IT admin is managing their systems. Microsoft Active Directory stepped up to the plate and created Group Policy Objects to help centrally manage Windows devices.
Unfortunately, AD cannot do the same for Linux and macOS devices. OpenLDAP cannot manage any devices. So instead of having the capability to authenticate, authorize, and manage all in one system, IT admins need to implement another software platform in order to manage their devices.
Managing OpenLDAP Yourself Isn’t Worth the Hassle
In an era of cloud infrastructure, web applications, and a variety of device types, there is no reason to struggle with OpenLDAP. Instead, organizations can leverage the underlying infrastructure and protocol, while skipping these critical issues.
Directory-as-a-Service is based on LDAP at the core, but extend to provide support for a wide variety of devices, applications, and networks. Modern day directory services need to be more than just LDAP. They need to be multi-protocol, available from anywhere, and sturdy enough to withstand the critical nature of authentication and authorization.
If you are looking for a next generation view of OpenLDAP, drop us a line and investigate Directory-as-a-Service. You can also try our cloud-based directory out for yourself. Your first 10 users are free forever.