LDAP · PKI · zero-trust · Kubernetes
LDAP, PKI, zero-trust, and the craft of running authentication that only gets noticed when it breaks. Written from 25 years inside production directories, and now from a Kubernetes lab where those lessons are being re-learned in a new environment.
Latest from the blog
Delta-syncrepl earns its keep on two shapes of workload, and most directories have neither. Here's the arithmetic that says whether yours does.
Read →The docs call slapd.conf deprecated. My clients like it anyway. Here's why that's not nostalgia but a deliberate engineering choice.
Read →Your directory has run untouched for years. That's not a win. That's the trap.
Read →Guides
Longer-form reference pieces. Start here if you're new to directory infrastructure.
Active Directory is LDAP. Your IdP federates to a directory. The VPN, the NAS, the sudo rules, and the wifi all bind to one.
One source of truth
Postfix routes from it, Dovecot authenticates against it, and in an Active Directory shop every alias already lives on the user. Addresses, routing, and mailbox lookups resolve from the same entries your logins do. One directory, not a mail config drifting out of sync beside it.
Add a person once. Their mailbox, their aliases, and their slot in everyone's address book all follow. The GAL is just an LDAP query.
virtual_alias_maps = ldap:ldap-aliases.cf query_filter = (|(mail=%s)(mailLocalAddress=%s)) result_attribute = mailRoutingAddress
passdb { driver = ldap } userdb { driver = ldap }
user_filter = (&(objectClass=inetOrgPerson)(mail=%u))proxyAddresses: SMTP:tiro@ldapguys.com # primary proxyAddresses: smtp:m.tullius@ldapguys.com targetAddress: SMTP:tiro@collegium-scribarum.rom
id_provider = ldap ldap_uri = ldaps://ds.senate.gov.spqr ldap_search_base = dc=senate,dc=gov,dc=spqr ldap_schema = rfc2307
passwd: files sss group: files sss sudoers: files sss
AuthorizedKeysCommand /usr/bin/sss_ssh_authorizedkeys # public keys live on the entry, via sshPublicKey
One login, every box
SSSD binds the Linux fleet to the same directory everything else uses. Users,
groups, sudo rules, and even SSH public keys resolve over LDAP. No local
/etc/passwd to drift, no per-host account sprawl to reconcile.
Onboard once, log in everywhere. Offboard once, and the keys stop working on every host at the same moment. RFC 2307 is doing the work.
FAQ
Almost certainly yes. If you run Active Directory, you run LDAP. AD speaks LDAP for directory lookups. Your VPN, wifi (802.1X), NAS, sudo rules, SSSD logins, and most app SSO all bind to a directory over LDAP, whether or not anyone calls it that.
LDAP is the protocol; Active Directory is a directory server that speaks it. AD is LDAP for directory reads and writes, plus Kerberos for authentication and Microsoft-specific schema and replication layered on top. OpenLDAP, by contrast, is a pure-LDAP server with no Kerberos bundled in.
Yes, and it's the normal way to do it. You run the old and new directories in parallel, replicate or sync entries across, cut over reads first and writes last, and keep a tested rollback at every step. No lost entries, no broken binds, no surprise outage.
I also take on a small number of consulting engagements. Work with me →