Manage large user databases for single sign-on

Question

How would you implement the system with the following goals:

• Authentication management, permission for hundreds of thousands of existing users who are currently closely integrated with a third-party application provider (we want these users to violate what we manage and to do our applications against it, and our third-party providers work against it).
• Manage profile information associated with these users
• It should be accessible from any number of web applications on almost any platform (Windows, * nix, PHP, ASP / C #, Python / Django, etc.).

Here are some implementation examples:

• LDAP / AD Server to manage everything. Use your own schema for all profile data. Everything can be authenticated against LDAP / AD, and we can store all kinds of ACLs and profile data in a user scheme.
• Use LDAP / AD only for authentication, bind LDAP users to the most reliable profile / authorization server, using some traditional database (MSSQL / PostgreSQL / MySQL) or a document-based database (CouchDB, SimpleDB, etc.). Use LDAP for authorization, then click on a DB for more advanced material.
• Use a traditional database (Relational or Document) for everything.

Are any of these three the best? Are there other solutions that meet the above objectives and are easier to implement?

** I must add that almost all applications that will authenticate against the user database will be under our control. The lone few outsiders will be applications in which we delete the current user database and possibly 1 or 2 others. Nothing so extensive that you need an openID server.

It is also important to know that many of these users have these accounts for 5-8 years and know their usernames and passwords, etc.

Answer 1

There is a difference between authentication and authorization / profiling, so do not force them into one tool. The second decision to use LDAP for authentication and the database for authorization seems more reliable, since LDAP data is controlled by the user, and the database will be controlled by the administrator. The latter is likely to change in structure and complexity over time, but authentication is just authentication. Separation of these functions will be more manageable.

Answer 2

If you have an existing ActiveDirectory infrastructure, this will be the way to go. This will be especially beneficial for companies that already have Windows servers installed for authentication. If so, I am leaning toward your first marker point in "exemplary implementations."

Otherwise, it will be a call between AD and open source LDAP options.

It may not be practical to roll back your authentication scheme for one-time registration (especially given the large amount of documentation and integration work that you may have to do) and, obviously, does not connect your authentication server to any of the applications running on your system (since you want it to be independent of the load of such applications).

Good luck!

Answer 3

Use LDAP / AD only for authentication, bind LDAP users to the most reliable profile / authorization server, using some traditional database (MSSQL / PostgreSQL / MySQL) or a document-based database (CouchDB, SimpleDB, etc.). Use LDAP for authorization, then click on a DB for more advanced materials.

Answer 4

We have different sites with about 100 thousand users, and all of them work with regular databases. If most applications can access db, you can use this solution.

Answer 5

You can always implement your own OpenID server. There is already a Python library for OpenID , so this should be pretty easy.

Of course, you do not need to accept logins allowed by other servers in your applications. Accept credentials allowed only by your own server.

Edit: I found an implementation of the OpenID protocol in Django .

Edit2: There is an obvious advantage to OpenID for users. They will be able to enter StackOverflow with their logins :-)