IAM Platform: LDAP, Kerberos, LemonLDAP::NG
Built a complete identity and access management infrastructure across several Debian VMs: a directory service, a Kerberos realm, a central SSO identity provider, and a series of web services each integrated with a different authentication method to verify that every building block interoperates correctly with the others.
What was built
- Directory: OpenLDAP with SSSD integration on client machines for system-level identity resolution.
- Kerberos: set up a simple realm first, then migrated it to an LDAP-backed realm (shared identity/authentication backend).
- LemonLDAP::NG: installed and configured as the central identity provider, integrated with LDAP, Kerberos and TOTP for two-factor authentication.
- Multi-site web services: several sites configured with different authentication methods - basic auth, direct LDAP, Kerberos-GSSAPI (transparent SSO), and SAML2 via LemonLDAP::NG.
- DokuWiki: integrated both with direct LDAP authentication (the
authldapmodule) and with SSO via SAML2 including group handling.
Graded assessment
The graded write-up covers precise technical questions on every building block:
ldapsearch queries, administration via kadmin.local,
Kerberos-GSSAPI authentication on Apache/PHP, LemonLDAP::NG SAML2 configuration (the
MELLON_NAME_ID attribute for post-SSO identification), DokuWiki's
authldap integration, and how it all ties into the PKI/mTLS setup built in other
TPs of the same curriculum.