2

We just began using a new software called SysAid which uses LDAP to authenticate users.

We have a client, which uses OpenAM to authenticate their users for a proprietary web application.

Our goal, is to use OpenLDAP as a sort of broker, or middle man, between the OpenAM server and the LDAP server. The end goal is to allow users to login to SysAID with their OpenAM credentials without having to create any additional accounts.

I've managed to get an OpenAM server and an OpenLDAP server running successfully in virtual machines, however I'm quite stumped as to what my next move should be.

There could be better ways to accomplish what I we want to do, otherwise some helpful pushes in the right direction would do my day wonders!

0

The end goal is to allow users to login to SysAID with their OpenAM credentials without having to create any additional accounts.

I was unable to get OpenAM to do this sort of thing a couple of years ago, but maybe they have cleaned it all up a bit. I had a lot better luck with Shibboleth.

The easy way to do this sort of thing would be to use SAML v2.0 or OAuth 2.0. SysAID would redirect a cookie-less access to the OpenAM server, which would ask for user IDs and passwords, and authenticate those against LDAP. After successful authentication, OpenAM would redirect back to SysAID. You can see that sort of thing in action by using SimpleSAMLphp, with the Feide OpenIdP.

I think you'll find that OpenAM is the middleman/broker, and that using OpenLDAP as the middleman will just complicate things.

0

Looking at this from SysAid standpoint, you could go with another solution; Instead of putting a middleman in the form of OpenLDAP server that will collect the data from OpenAM and then SysAid get's it from there, you could write external login class for SysAid that will allow to authenticate directly against OpenAM.

You will still need to somehow import the user details from OpenAM to SysAid, but if you could export the users from OpenAM to a CSV file, then you can import that into SysAid (and even schedule daily imports).

Keep in mind that writing an external login class for SysAid requires programming skills (Java) and requires OpenAM to actually support that (which I'm guessing it does).

You can contact the Professional Services team at SysAid and get pricing estimates for them to do the implementation for you, if you don't have the resources to develop this on your own...

0

This is going to depend heavily on how your OpenAM is configured, but in all but a small minority of cases it is already going to be using an LDAP backend (You can see this by going into Access Control -> [Realm] -> Data Stores).

If SysAid supports LDAP authentication, it should be able to authenticate against the same LDAP data store as OpenAM is using at the moment without having to create/manage new accounts. It won't be single sign-on, but it will be using the same users/groups/passwords etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.