Brain scratching around identity management and SSO reddit / selfhosted ---------------------------------------------------------------------- EinIntegrator · 2023-10-01 23:10 So my partner and I have been running a micro-MSP together handling individual systems and IT functions for about a dozen businesses for a couple of years. Mostly minor stuff that we can handle ourselves - Websites here and there, a few stand-alone mail servers in clients' cloud accounts, a few nextcmloud instances We recently started seeing some growth and have been approached about more comprehensive solution packages, but have a few constraints to juggle. I could use any feedback or advice from folks who have gone through these hurdles before because I'd like to avoid making really costly mistakes that bleed us out down the line \-Tentatively, to meet client needs We're to deploy * self-hosted knowledge base, still haven't selected an option. needs to be able to isolate knowledge resources to only the teams who should be accessing them. * Modern Self-hosted Email system with Web management interface their helpdesk person can use. * A nextcloud site for file sharing, Messaging and videoconferencing between * OpenProject deployment, * and a FreePBX-based VOIP system running Bria SoftPhones over the PBX. \-our prospective Client is vehemently anti-MS, his people work off Macs/iOS devices mostly; wants to avoid any facet of their infrastructure running off of Microsoft systems. Including Active Directory/mail/calendar. \-client wants a single truth-source for user management and SSO \-need to be able to deliver a prototype with each service integrated with SSO to show for approval within 4 weeks of signing; final system with branding, policy configuration, etc within 60 days after that I put the brakes on the contract negotiations for a few days because gaps in my own knowledge have made it difficult to architect a solution I am confident will be scalable. Among my concerns *-I have no experience building SSO integrations before; would appreciate any advice for solutions that might work for the software we need to rollout.* \-*Past projects we've worked on have been for clients running on an MS stack internally* While it's not a project constraint, with this many different servers in a single client's network and their employee base slated to grow nearly threefold in the next year, I feel it would be wise to have some kind of orchestration/configuration management/IaaC methodology, but don't have much experience to know my unknowns. would appreciate any advice or even just links to well written documentation or relevant tutorial resources that I can teach myself from Spent the last six hours trying to learn from google on options for self hosting identity, set up an experimental keycloak deployment in my lab to mess around with, but ultimately have come out of the venture more confused than I went in. From what I can tell OpenLDAP dominates the space outside of Microsoft's AD offerings, but I would appreciate if anyone could refer me to resources that helped them learn to understand LDAP and SSO integrations better. Honestly I would appreciate just any advice from more veteran admins on things I may not have considered before we go out and avoid hastily building a system that strangles us in maintenance and tickets. ---------------------------------------------------------------------- EndlessHiway · 2023-10-01 23:39 wrong sub. You should post on r/sysadmin ---------------------------------------------------------------------- revereddesecration · 2023-10-01 23:40 I have deployed Authentik as an authentication and authorisation platform for a non-profit. I can’t vouch that it’s the best available solution but I can vouch that I find it to be more friendly than the other ones I tried, including KeyCloak. I then deployed various self hosted FOSS that were chosen based on their support for SSO, mostly configured to use Authentik as an OAuth provider. Overall, good solution. ---------------------------------------------------------------------- RandomVanCityUser · 2023-10-01 23:58 Once upon a time I was you: a Microsoft sysadmin turned freelance cloud consultant. And my initial clients were like the one you described: anti-MS and wanted everything to use off the shelf self- hosted open source yet provide the reliability of a major SaaS. And like yourself, I pitched fixed priced contracts to deliver broad solutions demanded by the customer despite a lack of familiarity of the service's inner workings on either side of the business relationship. And oooooh did those contracts turn into a lot of unpaid work as the "simple" project scopes bloomed all out of control, because I was still new to the contracting world and wanted to deliver on the times and costs I had estimated. Every contractor goes through this growing process more than once, and I think you're about to enter into this situation. I'm not advising to ditch this client, but I would advise breaking it down into **several** projects. If SSO/IAM is the glue that will tie everything together and is a prerequisite to all other services, just pitch them on that project _only_ as see how the experience goes in terms of planning, effort, and estimation results. Finally, neither you nor the client realize that building systems like this are just one part of the equation... the on-going maintenance of it after deployment is the real issue at heart. Do you really want to be the sole person responsible for a company's entire IT infrastructure? When their PBX goes down and you're working at another client site, do you want to experience that kind of headache: TL;DR - tell your potential client that what they're looking for is called "Google Suite", then run like hell from them. There's easier, more interesting jobs out there. ---------------------------------------------------------------------- Acrobatic_Assist_662 · 2023-10-02 00:51 I think that u/EndlessHiway and u/RandomVanCityUser have the best answers for what you want, I think a good starting point/easy all-in- one solution may be univention corporate server. It’s an IdM with a lot of functionality close to AD where you’d feel familiar and its extensible with apps that will allow the identity management built in to blend in with whatever you add to it (ie it has some wiki/knowledge base apps). ---------------------------------------------------------------------- NikStalwart · 2023-10-02 01:11 > TL;DR - tell your potential client that what they're looking for is called "Google Suite", then run like hell from them. There's easier, more interesting jobs out there. lol & ouch, but you're not wrong. ---------------------------------------------------------------------- Reverent · 2023-10-02 02:24 I really would not suggest cobbling together a solution that you plan to essentially sell to another office, especially without experience. Synology's are basically built for the purpose you're describing. They have an integrated... everything... pretty much for what you're looking for. AD alternative, SSO alternative, onedrive alternative, backup alternative, etc. Sell them a pair of big synologies and set it up for them. ---------------------------------------------------------------------- contherad · 2023-10-02 04:40 Not selfhosted, but JumpCloud. They have an MSP offering. ---------------------------------------------------------------------- _mnz · 2023-10-02 05:25 I also want to get independent from MS Currently looking into: Authentic (also has 2FA ) Directory 389 OpenLDAP For knowledge management we are using WikiJS with a internal git repo in the back round. But the fit repo is not mandantory. Maybe this gives you an inspiration of what you can/will use ---------------------------------------------------------------------- bymarlin04 · 2023-10-02 07:22 maybe look into Univention Corperate Sevrer? could solve the SSO / AD replacement. I use them in a company of 50-ish people without issues ---------------------------------------------------------------------- TheBlueKingLP · 2023-10-02 08:59 Mailcow might do what you want for email https://mailcow.email/posts/2023/mailcow-idp/ ---------------------------------------------------------------------- paid-4-0-daze · 2023-10-02 09:21 For learning, I've used Active Directory and Shibboleth IdP. I'd rather deploy something like Google Workspaces or AzureAD/EntraAD though, much easier to manage. ---------------------------------------------------------------------- azukaar · 2023-10-02 09:47 Hello I am the developer of Cosmos [github.com/azukaar/cosmos- Server/](https://github.com/azukaar/cosmos-Server/) which can help. Full documentation about this here: [https://cosmos- cloud.io/doc/8%20OpenID/#nextcloud](https://cosmos- cloud.io/doc/8%20OpenID/#nextcloud) ---------------------------------------------------------------------- LightningJC · 2023-10-02 11:35 Just going to throw my 2 cents in there for a knowledgebase. I love bookstack for any and all documentation. https://www.bookstackapp.com ---------------------------------------------------------------------- sk1nT7 · 2023-10-02 12:26 Authentik with Traefik makes a good IdP. I've deployed it with Azure AD SSO. Steep learning curve but works very well. As soon as you understand the Authentik architecture, it gets more intuitive. I've written about it here: https://blog.lrvt.de/authentik-traefik-azure-ad/ ---------------------------------------------------------------------- oliverleon · 2023-10-02 12:55 +1 for Cosmos ---------------------------------------------------------------------- GolemancerVekk · 2023-10-02 13:52 Just one thing because I see this a lot: very often when people say "SSO" they actually mean "federated". Federated identity/authentication means the backend system is delegating id/auth to another system as the authoritative source. It does not mean that this system doesn't retain any user data though; it probably holds user local preferences or settings at the very least; it may even grab a whole bunch of other user data and cache it locally; it's just not authoritative for that data. Single Sign-On it's a feature that means that once the user has logged in to one service they will be automatically logged into other services that use the same id/auth backend. The two concepts are orthogonal. You can have SSO without federation and the other way around. You really need to clarify what the client means before you proceed because they might want one, the other, both, or something else entirely. > LDAP and SSO integrations It's best to refer to such systems as IAM (Identity and Access Management – where "Access" tends to be an umbrella term for authentication, authorization and policy). LDAP and SSO are specific solutions which may or may not be related to IAM. SSO I explained above. LDAP is actually a protocol and server for accessing directory services and cataloging resources. It tends to be used in relation to user accounts because it's well suited for CRUD operations around such entities but there are many other systems and protocols that can be used (X.500, Kerberos, even a plain relational database can work). It's important to note that LDAP is not *technically* IAM itself any more than a relational database is IAM, but it can *become* part of an IAM solution. ---------------------------------------------------------------------- patmorgan235 · 2023-10-02 14:54 For self hosted SSO, Central Authentication Service is an alternative to keycloak. It's an open source project that's used heavily in higher ed. It support SAML, OATH, OPENID, LDAP, etc. ---------------------------------------------------------------------- snaildaddy69 · 2023-10-02 16:10 This is uncomfortably accurate ---------------------------------------------------------------------- unistirin · 2023-10-02 16:57 I have worked on these technologies including saml. I learned LDAP from this guy https://youtube.com/playlist?list=PLfO6SFqcY2PrDR5yct96n4qfgMmh6g0eP&s i=tT5qouhqk4wNnH8F For SSO, all you have to do is set up an Identity federation with LDAP in Keykloak, and give proper DN information while doing so. Make sure you have your users segregated into different groups, so later you can access and control them via keylock ---------------------------------------------------------------------- EinIntegrator · 2023-10-02 18:14 This is a lot of wisdom to mull on. As it stands we’ve got a few decisions to make about how we grow. We have a few other deals and my partner saw this as an opportunity for us to prove out these offerings to be able to more readily offer the individual services to future clients as we grow as well as cutting our own internal costs (and our clients’ licensing expenses) as a way of growing our margins on deals as we move forward. But it’s also true this will create additional time Maintenance and scaling Demands that may not really be ideal until we have a larger team. We’re Gonna try to schedule a meeting with their current “webmaster” to try to get a better. We’d assessment of where their real needs and priorities are. ---------------------------------------------------------------------- CubeRootofZero · 2023-10-02 18:15 Try Zitadel for IAM and SSO ---------------------------------------------------------------------- EinIntegrator · 2023-10-02 18:42 Wow that is a really cool and ambitious project. Even if I don’t use it for this I’ll probably be throwing it up to experiment with soon. ---------------------------------------------------------------------- armaver · 2023-10-02 18:46 All of this is true, but! Instead of running away, just give the most conservative estimates you can, for every milestone along the way. Plan for the long term maintenance in advance and expand your team at the right time. You have a solid cash cow for a decade at least. ---------------------------------------------------------------------- EinIntegrator · 2023-10-02 18:46 That’s a good clarifying distinction to draw. Specifically at this time it is federation they care most about. They want all their users to have a single set of credentials across services and to be able to terminate employee access from a unified place. (Email/file sharing/messaging/voice/PM/kb) ---------------------------------------------------------------------- EinIntegrator · 2023-10-02 18:47 That seems decently affordable At a couple of dollars a user. Do you know if they offer data export in any portable format if you decide to migrate to another solution later? ---------------------------------------------------------------------- EinIntegrator · 2023-10-02 18:48 I will look into it, thank you for the suggestion. ---------------------------------------------------------------------- EinIntegrator · 2023-10-02 18:49 Appreciate the recommendation. I’ve heard good experiences with mature authentik deployments from a few people ---------------------------------------------------------------------- EinIntegrator · 2023-10-02 18:50 Appreciate the pointer. I had considered it but figured that given the self-custody and OS nature of the tasks at hand folks here in self hosted might have more relevant experiences to share and have gotten a ton of great advice from people in this threat. Sorry if I created any unwanted clutter here! ---------------------------------------------------------------------- DellR610 · 2023-10-02 21:28 If mail will be for external use I would avoid it being on-prem. You're going to spend a lot of time supporting it. Between filtering spam to figuring out why recipients aren't receiving mail. Personally if you're not hourly it's going to be a money pit. ---------------------------------------------------------------------- RandomVanCityUser · 2023-10-02 21:52 I hear ya, it's just your project time frame (30 days for prototype and 60 days for branded production solution in place) sounds like a nightmare to me in terms of customer expectations, especially as you're a Microsoft shop suddenly trying to self-teach Linux admin skills at the same time. This kind of project only works well if you have an existing/proven/reproduceable solution in place. If you're going to go ahead with this customer, do _not_ give a fixed price (because you can't estimate the effort), bill by the day instead. Likewise, if the rate you're charging doesn't embarrass you, then you're charging too little. Same for the maintenance contract, otherwise you're a bottom-priced solution for the customer as they're obviously trying to save money by hiring an employee for their IT support. Good luck, it'll be a learning experience one way or another! ---------------------------------------------------------------------- coderkid723 · 2023-10-02 22:16 Caddy Server and Caddy Security V2 for SSO ---------------------------------------------------------------------- contherad · 2023-10-03 01:06 I know they have a couple of reports you can run and you can use an open source ldap explorer to navigate through ldap. But I’m not sure if it would have exactly what you’re looking for. Everything is free for less than 10 users, so you can spin up a test and check it out. ---------------------------------------------------------------------- LieRevolutionary7989 · 2023-10-03 04:14 I am a fan of jumpcloud for admin stuff, then either cloudflare or traefik as a security layer, nextcloud obviously, then whatever you want for monitoring. Also I dockerize everything for ease of use. You could literally just have a different stack for each customer if you wanted. Works very well. Nextcloud does have nextcloud talk although I'm not sure it has the capabilities you are looking for. I am currently trying out zabbix for a monitoring solution and it seems very very expandable. Was a bear to get it operational since I dockerize it as well as use external storage but got it up finally. ---------------------------------------------------------------------- LieRevolutionary7989 · 2023-10-03 04:16 Oh and also jumpcloud works for authentication of about anything as well. Lmfao, saml, etc. It also has biometric authentication now and works with Windows hello. I don't have to sign in to anything anymore it just uses my face. And my nextcloud will build it's own accounts based off of jumpcloud users. ---------------------------------------------------------------------- LieRevolutionary7989 · 2023-10-03 04:31 How does this compare to homarr? That is what I'm currently using and the interface is great, it's docker integration is also very helpful and honestly it just works. This does look very nice though! ---------------------------------------------------------------------- Shoddy-Age3074 · 2023-10-03 04:52 y dont u just become a g suite reseller and then charge an admin fee to 'administer' the system and 'deploy/implement'. There's no way on earth except for very niche use cases that a self hosted setup would be the best thing for this client. If they had half a brain they'd just get g suite and be done with it, maybe confluence, cloud version too. These things will basically handle everything. then maybe get air call if u need a stand alone phone system. If you just want to milk this dummy for money then what ever. Make it as complicated as possible so it's too hard to migrate. ---------------------------------------------------------------------- netsecnonsense · 2023-10-03 05:33 Respectfully, unless you can get this client to go with a managed IdP you should turn this client down. 4 weeks to roll your own prototype system that’s way outside your depth of knowledge is asking for trouble. Especially when it comes to IAM. I know it’s hard to turn down big money on the line but use this experience as a reason to broaden your knowledge so next time you don’t have to say no. If you really feel like looking into FOSS options, Authentik is probably the easiest to set up. Keycloak probably has the largest community, and Gluu is likely the most robust (good luck setting it up though). Hopefully this didn’t come off as disrespectful. I did the Windows admin thing for some time before switching to cloud/Linux. It takes time to develop a stack that works for you. Better to do that piece by piece on smaller clients than to hook a wale and be forced to learn everything all at once. ---------------------------------------------------------------------- Hour-Inner · 2023-10-03 09:09 I second the tldr. The demands seem huge. Especially self hosted email. That will never be stable and imo is insane to try in a business situation. The day this stuff goes down or runs less than perfectly they will hound you like no tomorrow: “well we’re paying you for all this, just *make it work*” ---------------------------------------------------------------------- azukaar · 2023-10-03 15:55 You can use homarr with Cosmos, Cosmos is not a Homarr alternative. It's more of a NGINX + NPM + Authelia alternative with a bit of portainer in it (but you can still use portainer) ---------------------------------------------------------------------- Urvashi-JC · 2023-10-10 15:35 Hi u/EinIntegrator there's no easy way to export but there's lots of API endpoints and powershell commands that can help you pull all the information that you need. ---------------------------------------------------------------------- christystrew · 2023-12-08 11:50 Hey, you can explore [OneIDP](https://scalefusion.com/identity- management-oneidp/?utm_campaign=Scalefusion%20Promotion&utm_source=Red dit&utm_medium=social&utm_term=CM) for identity management. OneDirectory and OneID is already there and OneAuth is coming soon.