LDAP to control access to applications, how much should it control?

Question

Precursor: I now worked in two environments with conflicting principles. I am presenting competing ideas and would like to know what is “right” given the scenario described.

Scenario: There are several applications on our intranet. We are implementing OpenSSO with LDAP as our authentication directory and user. The problem is that with LDAP authentication, we know that the user is allowed on the intranet, but which applications are questionable.

We intend to use LDAP to control which applications each user can access, for example, a help desk, consultants review, report generator, survey creator, etc.

The question arises that within each application there is a significant number of roles and the fact that people can have several roles.

What is the best way to solve this second area? Shoudl ALL roles are in ldap or only in applications with each application base containing more granular roles?

Answer 1

One approach is to use LDAP to support relatively high-level role information, but keep very detailed application-specific information for each application.

For example, a user can be a member of LDAP groups (roles), such as "employee", "support desk assistant", "support desk manager", etc., and then individual applications will map high-level roles to application-specific functions. A specific high-level role can mean access to multiple applications, and different roles will have different access levels.

For example, a “help desk assistant” can create tickets, but perhaps only a supervisor can delete them or run reports.

This is one of those areas where there is not a single correct answer. Centralizing everything in LDAP gives you the best opportunity to report / verify access for individuals by complicating your central LDAP scheme with a lot of data related to specific applications. In addition, depending on which existing / commercial applications you are trying to integrate, applications may not support retrieving all fine-grained access information from LDAP.