SSO

SSO involves two core security concepts: identity and authentication.

A user identity is the abstract representation of an individual who needs access to a system or an application.
It typically includes attributes such as a username, password, user ID, and email address.
Authentication is the act of proving that an individual is the legitimate owner of an identity.

Elements of SSO

Four elements:

  1. A centralized directory store that contains user identity and authorization information. Commonly based on Lightweight Directory Access Protocol (LDAP).
  2. A tool for managing user information in the directory. Active directory users and computers is a GUI for this.
  3. A mechanism for authenticating user identities. You can authenticate users directly against an LDAP store, but it’s also common to use the Kerberos ticket-based authentication system originally developed at MIT. Active Directory supplies LDAP access to user identities and uses a customized version of Kerberos for authentication. UNIX and Linux use PAM and point it it to sssd.
  4. Centralized-identity-and-authentication-aware library routines configured via /etc/nsswitch.conf. These routines (getpwent, etc.) historically read /etc/passwd and /etc/group, but are now configured to query centralized identity sources instead.

Time synchronization (NTP) and hostname mapping (DNS) are critical for environments that use Kerberos because authentication tickets are time stamped and have a limited validity period.

1

LDAP

A directory service is just a database

Main LDAP implementations: Active Direcotry, OpenLDAP, 389 Directory Server.

The most common use of LDAP is to act as a central repository for login names, passwords, and other account attributes

LDAP Data Structure

dn: uid=ghopper,ou=People,dc=navy,dc=mil
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: ghopper
cn: Grace Hopper
userPassword: {crypt}$1$pZaGA2RL$MPDJoc0afuhHY6yk8HQFp0
loginShell: /bin/bash
uidNumber: 1202
gidNumber: 1202
homeDirectory: /home/ghopper

An example of LDIF (LDAP Data Interchange Format) using a simplified /etc/passwd file, which is used by most LDAP-related tools and server implementations.

Pithy

dn distinguished names are basically unique URI paths for LDAP entries.

Entries are organized into a hierarchy through the use of “distinguished names” (attribute name: dn) that form a sort of search path. As in DNS, the “most significant bit” goes on the right. In the example above, the DNS name navy.mil has structured the top levels of the LDAP hierarchy.

dn: uid=ghopper,ou=People,dc=navy,dc=mil
domain        = mil
subdomain     = navy.mil
ou (folder)   = People
specific user = ghopper

LDAP entries are typically schematized (enforced format) through the use of an objectClass attribute.

(ldapsearch)[https://man7.org/linux/man-pages/man1/ldapsearch.1.html] is a cli tool to interact with ldap databases.

Unix/Linux as an LDAP client

Tools

  • realmd - just a config helper that bootstraps the others, no runtime
  • PAM - Delegate auth requests to sssd and other authenticate modules
  • Kerberos - join system to AD domain (realmd does this automatically)
  • sssd - configure to talk to your identity store (LDAP/AD/Kerberos)
  • nsswitch.conf - config for sssd

sssd

System Security Services Daemon

  • Configure PAM to point to sssd for authentication.
  • Configure sssd with nsswitch.conf.

You should be able to do getent passwd and see your local /etc/passwd and the remote /etc/passwd (really from LDAP)

PAM

PAM is a modular authentication abstraction layer.

  • Configuration files (/etc/pam.d/login) define which authentication services to call, their ordering and how to handle responses (required, optional, sufficient).
  • Swap auth backends by changing config, not application code.
Edit this page
© 2026 Monjiapawne