Navigating Identity Authentication: From LDAP to Modern Protocols

When constructing the identity authentication mechanism for network applications, engineers face various choices. One approach is to design a custom authentication mechanism, which may be suitable for certain newly developed applications. Another approach is to adopt widely recognized popular standards, which not only aids in compatibility with legacy applications but also ensures interoperability with other services, thereby simplifying the integration process. Therefore, a deep understanding of common identity authentication technologies is crucial for building robust and interoperable identity authentication services.

LDAP / Active Directory

LDAP (Lightweight Directory Access Protocol) is an IP-based protocol specifically designed for accessing directory services. It's worth mentioning that Microsoft's Active Directory also supports this protocol.

Directory services are a special form of database that organizes various resources (such as users, organizations, devices, etc.) using unique identifiers. This structured data storage enables clients to query the required resources in the database using specific search syntax. For resources stored in directory services, they can contain rich attribute information, such as a user's name, email, phone number, etc. For specific LDAP servers, there are usually some built-in templates to specify the requirements for attribute keys and values, ensuring data accuracy.

In enterprise environments, LDAP/Active Directory applications are particularly widespread. Enterprises can store employee information in a hierarchical structure based on their departments, and each "user" resource can store basic information and user credentials of employees.

Integration of LDAP in Applications

For many existing applications, LDAP protocol integration has become an important feature, either built-in or implemented based on extension mechanisms. Taking Apache APISIX as an example, it has successfully implemented LDAP integration through a flexible plugin mechanism. This integration allows clients to send usernames and passwords in basic auth format, then query and validate user credentials on the LDAP server, effectively securing API requests.

In applications and services developed by engineers, LDAP protocol can also be utilized to implement user management and authentication functions. By using LDAP client libraries provided by specific programming languages, it's easy to connect to LDAP services. Once the connection is established, the Search API can be used to query resources in the directory and retrieve the required user attributes.

Pros and Cons of LDAP

Pros

• Centralized storage and efficient querying: Data is centrally stored in directory services, and its organizational structure greatly enhances query speed, making it easy to handle large volumes of read requests.

• Intuitive tree structure: The tree structure of directory services closely resembles the organizational structure of the real world, making resources conveniently indexed on leaf nodes, aligning with users' intuition.

• Widespread application integration: Due to its maturity and stability, LDAP protocol provides built-in integration support in many software.

Cons

• Outdated protocol: LDAP protocol was designed in earlier days, using ASN.1 encoding, which differs significantly from the mainstream JSON format today, making integration somewhat challenging.

• Limited functionality and compatibility issues: The protocol itself has limited functionality, leading to some LDAP server software having to extend through non-standard means, which may affect compatibility across different LDAP servers.

• Complex configuration and security challenges: LDAP server configuration involves many security factors, such as TLS and data access control, requiring rich experience to ensure correct configuration, otherwise risking data leakage.

• Application implementation difficulty: From the application perspective, accessing LDAP servers is similar to accessing databases, requiring the use of lower-level APIs like Search for data access, posing high demands on application developers.

The Modernization of LDAP

Although the LDAP protocol may seem somewhat outdated in the current technological environment, it is still widely supported by many mainstream software as a classic standard. Many enterprises still rely on LDAP to manage various resources within the organization, and its stability and reliability have been verified in practical applications.

To overcome some limitations of the LDAP protocol in modern applications, some middleware products have emerged. These middleware encapsulate the LDAP protocol internally and provide more modern and user-friendly protocol interfaces, such as OpenID Connect:

• Dex: https://dexidp.io
• Keycloak: https://www.keycloak.org

They handle protocol conversion and adaptation, providing modern protocols to reduce the integration workload for application developers.

These middleware products are responsible for protocol conversion and adaptation, providing application developers with more modern and efficient integration methods, effectively reducing the workload required to integrate LDAP.

HTTP-Based Identity Authentication Mechanism

In the field of identity authentication, HTTP-based protocols play a crucial role. OpenID Connect (OIDC), SAML, and CAS are among the representatives.

OpenID Connect

OpenID Connect is an extension of OAuth 2, providing not only authorization capabilities but also enhancing identity authentication capabilities. Compared to the limited functionality of OAuth 2, OIDC offers richer features, such as core id_token functionality and OIDC discovery standards.

The advantage of OIDC lies in its widespread application and rich ecosystem. Mature server and client implementations are available in various programming languages, facilitating integration and deployment. In addition, OIDC can be combined with other technologies, such as using JSON Web Tokens (JWT) as tokens, leveraging their statelessness to reduce the load on identity authentication services.

CAS

CAS (Central Authentication Service) is a widely used identity authentication protocol in web scenarios, used to implement single sign-on functionality. The CAS protocol is relatively simple in design and easy to integrate into various applications. Additionally, it can be used in production. It's worth noting that identity authentication management platforms like Keycloak also support the CAS protocol, further expanding its application scope.

SAML

SAML (Security Assertion Markup Language) is a long-standing identity authentication protocol, with the current version SAML 2.0 released in 2005. The protocol uses XML as the encoding method for inter-service communication and defines unique data structures. However, due to the relatively complex implementation of SAML and its less intuitive and straightforward usage, its advantages are not as apparent when compared to modern identity authentication protocols like OIDC and CAS.

Nevertheless, identity and access management solutions like Keycloak still provide server implementations of SAML to meet identity authentication needs in specific scenarios.

User Identity Synchronization and Management

Consider a common scenario: an enterprise provides multiple internal application systems to its employees and adopts single sign-on to enhance user experience. However, whenever a new employee joins or an old employee leaves, IT administrators need to manually create or delete accounts in various systems, a process that is not only cumbersome but also accompanied by potential security risks.

To address this issue, IT administrators urgently need a standardized, automated user account management tool. It is in this context that the SCIM (System for Cross-domain Identity Management) standard emerges.

The SCIM standard defines a series of specific REST APIs designed to achieve seamless interoperability between IDPs (identity providers) and application systems or SaaS services. Through these APIs, users can automatically configure accounts, greatly simplifying the process of account creation, updating, and deletion.

Since its introduction, the SCIM protocol has been widely adopted and applied. For example, well-known identity management solutions such as Microsoft Entra ID (formerly Azure Active Directory) and Okta support the SCIM protocol. In addition, open-source identity and access management platforms like Keycloak also provide SCIM server/client extensions, further enriching their application scenarios.

Conclusion

This article briefly outlines the major technologies widely used in identity authentication scenarios. In the process of building efficient and secure identity authentication services, these mature technical solutions play a crucial role. They not only greatly simplify integration work and improve work efficiency, but also effectively reduce security risks, ensuring the security of enterprise data and user information. By leveraging these technological solutions, we can better meet the demands of modern identity authentication, delivering a more convenient and secure experience for both enterprises and users.