1

My organization has to get rid of their ldap servers, so I am facing the task of replacing it's functionality. To make this as customizable and future-proof as I can, I am looking for something that can run on any webserver, so in the future could be reimplemented in nginx, apache2 or whatever using anything from from php to js.

So far I have found a replacement for pam: The pam_oauth2.so module by quarxConnect queries a custom oauth2 implementation, that can be setup to pull it's data from anywhere.
This works quite nicely as a drop-in replacement for pam_sss.so in the pam configuration.

It doesn't however replace ldap in nss or autofs. autofs could be solved on the file servers side, but I couldn't find anything for nss.

I am really grasping at straws now, to the point where I have considered making the /etc/passwd and /etc/groups files sockets to a program, which queries the required data from a webAPI and constructs a file on-the-fly. I have no experience on how to implement that though, and it seems like a stupid solution frankly. sssd appears to do the same thing, but it can somehow detect which user's info is needed, so only construct that line.

If someone could point me to some documentation on how to build a module for nss, that would be great too. I couldn't find what calls such a module would have to answer and how I could call it from nss (nsswitch.conf uses aliases of some sort, not paths or filenames to some dir, from what I can tell).

I am fairly deep down this weird road, but am open to entierly different replacement approaches as well. Even something weird like a web-server implementation of an ldap-server which talks ldap to clients but pulls it's data from wherever. I'd prefer a simpler protocoll though.

Improve this question
5
  • 1
    As the name implies, LDAP provides directory services. Its primary use is to store information about people, computers, services, as so on. It can be used for authentication (e.g,, implicit using an LDAP bind or matching a raw password hash in userPassword), but it doesn't have to be. Is the intent just to get away from LDAP as an authentication source? Or is your organization trying to get out of the business of running a directory altogether? Commented Sep 8, 2021 at 15:35
  • First, document all the uses of LDAP at your organization, then plan replacements for each, design solutions, then write code. Implementation via Whack-A-Mole is suboptimal. Commented Sep 8, 2021 at 18:58
  • @JamesSneeringer The later. It just so happens the authentication and especially user information (which users exist, their groups, homes, shells, ...) is really hard to replace. The other info in ldap is used only in places easily customisable, like by web-backends or our DNS+DHCP system, so I managed to point those to webapis effortlessly. Commented Sep 9, 2021 at 16:23
  • @waltinator you're right, thats actually what I did, I phrased the question vaguely in case there is some nice all-in-one replacement. That would be great of course, but I really only need a good solution for nss and possibly pam (so something for sssd would work too), the rest is already taken care of. We have a ton of custom software, so most is very easy to point to anything, I only used oauth2 because I thought it would make my work and that of my successors easier. Commented Sep 9, 2021 at 16:30
  • 1
    The only other reasonable NSS replacement for Unix account information is NIS, and I wouldn't recommend going down that road. LDAP is the industry standard for this. It's also worth distinguishing between running LDAP as a commodity service (with your own apps built on it), and running a service that happens have an LDAP component for its own private use. You may want to take a look at FreeIPA (or Identity Management with RHEL), which is the latter. It has some support for migrating account data from other LDAP directories, which may simplify things for you. Commented Sep 9, 2021 at 17:35

0

Reset to default

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.