3

The basic requirement is to centralize the authentication and authorization of multiple SaaS applications to ease development (each SaaS application using minimal code to authenticate against a single source) and when necessary provide SSO. The authentication mechanism must handle the following options available to the user:

  1. Use Third Party Authentication -- Google
  2. Use our centralized authentication
  3. Use the corporate provided authentication (ADFS)

In my research, I have found many, many ways this can be done and have found OpenAM to be the most complete solution, but then I came across FreeRadius which could also be used.

My Questions are:

  1. There seems to be a plug-in for each tool where one can use the other together (OpenAM - authenticate against radius server), but is there any use case where FreeRadius would be preferred as the SOLE authentication server over OpenAM.

  2. Does OpenAM require that a web agent installed for the server - if all I am doing is serving a Restful Interface (developed in Node.js) - is it possible to authenticate users without installing a web agent (there is no web agent for Node.js).

  3. Can I pass user credentials from Browser -> Server (node.js) -> OpenAM thereby not giving the user the OpenAM login screen. The OpenAM token will be passed from OpenAM -> Server -> Browser (setting the cookies's origin as the SaaS's application. That is each SaaS application server will serve as a "proxy" for user management (authenticate, authorize, and manage[create|update|delete] users)

Thank you

4

3 回答 3

1

我很早就开始使用 Open Identity Stack 游戏，但我正在部署一个基于 OpenAM（和 OpenIDM + OpenDJ）的解决方案来准确处理您提到的解决方案。

直接回答：

  1. 至于将唯一身份验证移交给 FreeRadius，我不明白您为什么要这样做，但一切皆有可能。鉴于您提到了多个目录（身份来源 - google、ADFS 和您的集中式身份验证），我认为连接 OpenAM 以提供 RADIUS 身份验证（即 OpenAM RADIUS 挂钩，而不是 FreeRadius）是有意义的。
  2. 不，不必应用网络代理，但它可能有意义。有一些 node.js 可以提供帮助（https://github.com/alesium/node-openam）。您只需要从您的服务器与 OpenAM 端 (REST) 对话，这应该很好。
  3. 您可以这样做，或者您可以只为 OpenAM 登录屏幕设置外观，使其看起来像您自己的一样。我建议使用后者，因为您随后依赖 OpenAM 来确保登录屏幕的安全性。如果你正在做一个纯粹的代理，那么你就承担了这个负担。您的电话显然是一个设计决定。

祝你好运！

于 2013-06-06T11:14:52.313 回答
0

您正在将 RADIUS 服务器与 Web SSO 解决方案进行比较……我不确定这是否有意义。

似乎 FreeRadius 没有那么多“身份验证后端”（例如 Oauth 来利用 Google 身份验证）

于 2013-04-07T10:07:44.327 回答
0

我自己正在研究类似要求的解决方案，但我也希望集成 2FA。我见过很多不同的解决方案，但还没有找到最好的解决方案。到目前为止，这是我想出的：

  1. RCDev OpenID 似乎相当全面，对于少于 40 个用户的情况，它是免费的。
  2. Green Rocket 的 GreenRADIUS 价格昂贵，但他们有适用于各种场景的插件并且可以正常工作。
  3. Red Hat 的 KeyCloak 可以与 TACACS+ 或 FreeRADIUS 结合使用来完成此任务
于 2019-03-29T16:40:44.680 回答