Millions of accounts compromised because there is no specialised user database

Re:Millions of accounts compromised because there is no spec... by andrewstuart on Tuesday April 21, 2015 @09:59PM (#9418280)

My uninformed perception of OpenLDAP is that it is a large, generalised enterprise class directory service that does alot of stuff. The post suggests a minimal, lightweight user database that does nothing at all else - is that the same thing as OpenLDAP?

[ Parent | on HN ]

Re:Millions of accounts compromised because there is no spec... by Spooky23 on Tuesday April 21, 2015 @10:17PM (#9418342)

Pretty much.

I wouldn't characterize the magical detection of uncommon access patterns as a minimalist feature (it can be done, but not out of the box in a meaningful way), but other than that, all of the stuff you mentioned is there.

Typically, you use LDAP as a directory store, and a dedicated authentication protocol like Kerberos or SAML for authentication. You can also use LDAP for auth if desired.

If you want to go deep on identity management, the NIST documents are pretty much the canonical source of information. http://csrc.nist.gov/projects/iden_ac.html

In any case, don't reinvent the wheel. Just because bozos implement user auth in a MySQL table doesn't mean solutions don't exist. It just means that they are bozos. It's one of the reasons I disapprove use of SaaS apps that don't support federated identity at work.

[ Parent | on HN ]

Re:Millions of accounts compromised because there is no spec... by andrewstuart on Tuesday April 21, 2015 @10:28PM (#9418366)

Does OpenLDAP meet the stated need for a minimal solution that does nothing else apart from the small set of required functions?

I get the impression that OpenLDAP is a big beast that does much, much more.

I'm wanting a fast motorbike and you're pointing at a 16 wheel heavy hauler saying "see, same thing, the hauler has at least two wheels and an engine".

[ Parent | on HN ]

Re:Millions of accounts compromised because there is no spec... by Spooky23 on Tuesday April 21, 2015 @10:38PM (#9418398)

Note I didn't endorse OpenLDAP at all. Not sure if that's the best solution -- I'd probably steer towards 389 server or something similar with Netscape heritage.

You also said:

"Another problem is that developers roll their own user and password management systems and get things like salting and hashing wrong, making the data vulnerable."

You're asking for a distributed, secure system for processing user data and credentials. The most common systems in production globally for doing this (Microsoft Active Directory) are based on technologies developed in the 80's and only being supplanted in recent years. There's a reason for that, and if it were a trivial problem, we wouldn't have pervasive solutions using 1980s RPC in 2015 still running most businesses!

[ Parent | on HN ]

Re:Millions of accounts compromised because there is no spec... by untog on Tuesday April 21, 2015 @10:38PM (#9418400)

There is sometimes a reason for a piece of software being large. Security is one of those reasons.

If you want a secure system you shouldn't be prioritising a "minimal solution". As the previous poster said, don't reinvent the wheel.

[ Parent | on HN ]

Re:Millions of accounts compromised because there is no spec... by ubernostrum on Tuesday April 21, 2015 @11:54PM (#9418594)

I wouldn't characterize the magical detection of uncommon access patterns as a minimalist feature (it can be done, but not out of the box in a meaningful way)

I'm not even sure about a meaningful way. For sake of portability the DB will need to have some way to dump everything. And if a server admin can do that, then someone who can get the same access as a server admin can do it, and we're back to square one.

[ Parent | on HN ]

Re:Millions of accounts compromised because there is no spec... by hyc_symas on Wednesday April 22, 2015 @01:00PM (#9421781)

OpenLDAP comes with a lot of optional modules to implement enterprise directory features. You don't need to use them all. You can build a minimal OpenLDAP system that's dedicated to user authentication that runs in under 4MB of RAM, with full TLS/SASL/GSSAPI security. You can't even do that with SQLite, the SQLite binary alone is 2MB and that doesn't give you any network interface or security features.

[ Parent | on HN ]

Re:Millions of accounts compromised because there is no spec... by SFjulie1 on Tuesday April 21, 2015 @11:43PM (#9418560)

LDAP is a network protocol.

It supports a lot of backends (SQL and NoSQL alike) (openLDAP has nice proxy features)

It also supports role based authentication.

But at the opposite of actual NoSQL data bases, even though it has no structures, it is strongly typed and secure.

You map your NoSQL structures to structured backend through a mapping.

It is awesome but most devs hates it, because they are (at my opinions) ignorants. And developers hates it because they are lazy.

[ Parent | on HN ]

Re:Millions of accounts compromised because there is no spec... by smoyer on Tuesday April 21, 2015 @11:06PM (#9418458)

Try OpenLDAP with Fortress and you get a RESTful interface and ANSI RBAC compliant roles and permissions.

[ Parent | on HN ]