{"id":4396,"date":"2020-08-06T07:00:00","date_gmt":"2020-08-06T13:00:00","guid":{"rendered":"https:\/\/www.jumpcloud.com\/blog\/?p=4396"},"modified":"2024-02-08T11:11:16","modified_gmt":"2024-02-08T16:11:16","slug":"protocols-using-identity-management","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/protocols-using-identity-management","title":{"rendered":"Which Protocols Should Be Used for IAM?"},"content":{"rendered":"\n
A core, foundational element to understand with identity and access management (IAM) solutions<\/a> is protocols.<\/p>\n\n\n\n Identity solutions often depend on industry-standard authentication protocols. Unfortunately, different types of IT resources generally support different authentication protocols. <\/p>\n\n\n\n Organizations have a mixture of all of these types of resources, but their identity and access management solutions may only support only one or a couple of these authentication protocols. That causes IT organizations to build a collection of solutions that ultimately comprise their entire IAM infrastructure.<\/p>\n\n\n\n Generally, this type of cobbled together infrastructure gets the job done. But rarely does this work efficiently and securely, and in a way that requires minimal maintenance. And, that should be your goal with an identity management architecture.<\/p>\n\n\n\n The best approach is to determine which authentication protocols are in use (or should be), find an identity management solution that supports those protocols, and then employ one single IAM solution that doesn\u2019t have to be modified just to reach bare minimum functionality.<\/p>\n\n\n\n Below, we provide an overview of the major identity protocols in use today.<\/p>\n\n\n\n Okay, so native authentication isn\u2019t exactly a protocol. In fact, it\u2019s just the opposite.<\/p>\n\n\n\n We include it on this list to emphasize the point that most devices have their own authentication mechanisms. While some devices can access LDAP, for example, the challenges to connect those devices to LDAP are significant.<\/p>\n\n\n\n Specifically, Windows and macOS devices are challenging to manage with third party protocols. As a result, while there may not be a specific protocol, the APIs to create and manage users on Windows, Mac, and Linux\u00ae<\/sup> devices are critical for any identity management solution.<\/p>\n\n\n\n One of the oldest and most durable authentication protocols, LDAP <\/a>has been an industry standard since the mid-1990s. Lightweight Directory Access Protocol is often used for connecting to Linux devices, NAS devices \/ file servers, and more technical applications, as in DevOps environments. Many on-premises applications and storage devices still authenticate to the LDAP protocol.<\/p>\n\n\n\n LDAP is flexible and customizable, which is powerful, but it is notoriously difficult to configure and administer. In recent years, cloud-based and managed LDAP<\/a> solutions emerged to streamline LDAP\u2019s capabilities for organizations.<\/p>\n\n\n\n Use LDAP for:<\/strong> Linux devices, NAS devices\/file servers, technical applications, on-prem applications.<\/p>\n\n\n\n Invented at MIT, Kerberos<\/a> is used extensively under the hood by Microsoft as the authentication protocol for Windows and Windows-related systems.<\/p>\n\n\n\n The primary benefit in Windows networks is the ability to automatically sign-in users to any resources connected to the domain. With the steady move to SaaS-based applications, Kerberos has become a less important authentication protocol, but it is still used widely by Microsoft for their on-prem domain controller. <\/p>\n\n\n\n Also, it\u2019s important to note that, with the changing IT landscape, many organizations have shifted away from an on-prem domain<\/a> to the domainless enterprise architecture, relegating Kerberos to be somewhat less relevant than it was a decade or so ago.<\/p>\n\n\n\n Use Kerberos for:<\/strong> Windows systems, on-prem Microsoft applications \/ server infrastructure<\/p>\n\n\n\n Remote Authentication Dial-In User Service (RADIUS)<\/a> is an authentication protocol primarily used by networking solutions such as wireless networks, VPNs, and network infrastructure equipment. RADIUS servers generally connect back to a central directory service which contains user credentials. RADIUS was primarily used by ISPs and the like early on, but has since been repurposed to control WiFi networks and VPNs.<\/p>\n\n\n\n As with LDAP, there are options for companies that would rather not deal with their own RADIUS servers. RADIUS-as-a-Service (RaaS)<\/a> provides you with pre-built, pre-configured, scalable, redundant, and fully managed and maintained RADIUS servers.<\/p>\n\n\n\n Use RADIUS for: <\/strong> wireless networks, VPNs, network infrastructure equipment.<\/p>\n\n\n\n Security Assertion Markup Language (SAML<\/a>) is the authentication protocol most often associated with single sign-on solutions<\/a> for web applications. The open standard is employed widely by service providers (web application providers) and identity providers (web application SSO solutions).<\/p>\n\n\n\n SAML implementations are defined by an identity provider and a service provider. A service provider is, for example, a web application that a user wants to access. The service provider will request authentication from an identity provider, which is ultimately backed by a directory service. Historically, identity providers were merely proxies for the core directory service, but with platforms such as Directory-as-a-Service, those functions (IdP & SSO) are merging.<\/p>\n\n\n\n SAML has made great inroads into the web application sector, but is generally not relevant for devices and generally not used by internal applications due to the overhead to adopt it.<\/p>\n\n\n\n Use SAML for:<\/strong> web applications.<\/p>\n\n\n\n Another authentication mechanism for web applications, OpenID has gained some adoption due to support from significant consumer facing web applications such as Google\u00ae<\/sup> and Yahoo!. OpenID works similar to SAML<\/a> but is less complex to implement. Using OpenID, a third party web application could allow users to log in to their services via a Google, Microsoft, Facebook, Twitter, or Yahoo ID, for example.<\/p>\n\n\n\n This authentication mechanism is used for consumer facing web applications, although it is starting to gain some traction in business scenarios due to the popularity of G Suite\u2122 (formerly Google Apps for Work<\/a>).<\/p>\n\n\n\n Use OpenID for:<\/strong> web applications.<\/p>\n\n\n\n\nDifferent Authentication Protocols Make Things Complicated<\/h2>\n\n\n\n
So What Authentication Protocols Are You Using?<\/h2>\n\n\n\n
Native Authentication<\/h3>\n\n\n\n
LDAP<\/h3>\n\n\n\n
Kerberos<\/h3>\n\n\n\n
RADIUS<\/h3>\n\n\n\n
SAML<\/h3>\n\n\n\n
OpenID<\/h3>\n\n\n\n