2

I'm looking for the possible existing solutions to centralized user management. Most of the documentation found online refers to LDAP (Active Directory in particular) but I would like to know if there are other alternatives which might be better suited for the result we want to achieve.

Current situation

We currently have about a dozen servers, some bare-metal, most virtualized (VMWare) running at our company. Most of them are Windows Server but some are Linux as well. We have 2 networks (DMZ and private) in our department, not every server is connected to both networks. At the moment we have set seperate user accounts for everyone on each server (if they need an account on that server, not everyone requires access to all of them), with their individual permissions. Our users can login through Remote desktop, SSH or through Microsoft SQL Server depening on the type of server we are dealing with. The client computers our employees use to login on the servers are already inside an LDAP configuration, which we can not use for our servers. (This LDAP is being maintained outside our department). The problem with this setup is that now whenever we have a new employee, or more regularly, an external consultant coming in, we have to create a user account manually on each server and set their required permissions. Resulting in some server managers not even bothering and just using the Administrator accounts.

Desired situation

User accounts are created once for the entire server park and are assigned to user groups, through these user groups the user will automaticaly get the derived user rights on all relevant servers. Users can then login on the servers with their username and password through either Remote Desktop, SSH or SQL Server (SQL Server Access can be linked to Windows User Groups). Preferabbly Administrator accounts would be locked and the servers remain accessible/operational when the central user management server goes down.

What I'd like to know

I would like to know which different technologies (not specific products) exist to achieve this goal and if possible what their pros and cons are. Some technologies I have come across are Puppet and Metadata, however they don't really feel like proper solutions to me. Although, I find it hard to believe Active Directory would be the only working solution in existence. But of course, if it is, I'd like to know why :).

  • Looking for alternatives is good, but you'll end up with Active Directory anyway, maybe with some additions to better integrate the Linux part. – Sven Jul 27 '17 at 11:45
  • Well I have come across Puppet and Metadata and others which vaguely achieve a similar goal. I feel like AD would be overkill in this situation but I might be wrong. Maybe there even is a lot of variation within the LDAP world itself. Is there a lot of difference using OpenLDAP instead of AD? – Gilles Lesire Jul 27 '17 at 11:48
  • Puppet is a config management tool. While you can automate user creation with this, that's not "centralized user management" at all. LDAP is an integral part of Active Directory, but getting just OpenLDAP to work with Windows is a lot more involved. Most enterprise Linux distros are prepared to work with AD more or less easily, but Windows is a lot more difficulty to get running with alternative products. Note though that Samba4 is capable of simulating AD. – Sven Jul 27 '17 at 11:55