I am currently designing our new internal IT services, including IAM and e-mail. We currently use more or less no IAM or single sign-on solution. We have a WordPress based website, postfix + dovecot based mail server with separate MySQL user database, we currently rely on local users everywhere.

I would like to change that and implement an IAM solution, I am heading towards Active Directory as it has some great capabilities and is easy to support almost anything including Linux os-level accounts.

For MS Active Directory, we would like to use a combination of a small static password per user (4-8 characters) + 6 numeric characters Google Authenticator one-time-password.

I was wondering if anybody implemented something like that and what would be the best moving forward? I can think of two possible directions, one is to use software such as AuthLite, second is to implement FreeRADIUS integrated with Google Authenticator thru PAM and configure Active Directory to use this external FreeRADIUS server to authenticate against, does anybody know on how to achieve the later?

  • FWIW, AD is not an IAM system. It's a perfectly fine user directory and can be easily used as an authoritative source of authentication from many different OSes and applications, but it's not IAM. – EEAA Feb 22 '16 at 21:20
  • Now AD DS + AD FS is a perfectly fine IAM. – Joel Coel Feb 22 '16 at 21:26
  • Doesn't AD have ability to support google authenticator out of the box? – Jonesome Reinstate Monica Mar 17 '16 at 16:43
  • I could not find any tutorial how to configure it, so I believe it does not :-( – Mark Mar 19 '16 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.