Active Directory authentication for SaaS product

Question

After some theoretical help on the best approach for allowing a SaaS product to authenticate users against a tenant's internal Active Directory (or other LDAP) server.

The application is hosted, but a requirement exists that tenants can delegate authentication to their existing user management provider such as AD or OpenLDAP etc. Tools such as Microsoft Online's hosted exchange support corporate AD sync.

Assuming the client doesn't want to forward port 389 to their domain controller, what is the best approach for this?

Answer 1

After doing some research and talking to a few system admins who would be managing this, we've settled on an two options, which should satisfy most people. I'll describe them here for those who were also interested in the outcome.

Authentication Service installed in the origanisation's DMZ

If users wish to utilise authentication with an on-premises active directory server they will be required to install an agent in their DMZ and open port 443 to it. Our service will be configured to hit this service to perform authentication.

This service will sit in the DMZ and receive authentication requests from the SaaS application. The service will attempt to bind to active directory with these credentials and return a status to indicate success or failure.

In this instance the application's forms based authentication will not change, and the user will not be aware of the authentication behind the scenes.

OpenId

Similar to the first approach, a service will be installed in the client's DMZ, and port 443 will be opened. This will be an OpenId provider.

The SaaS application will be an OpenId consumer (already is for Facebook, Twitter, Google etc login).

When a user wishes to log in, the OpenId provider will be presented, asking them to enter their user name and password. This login screen would be served from the client's DMZ. The user would never enter their username or password into the SaaS application.

In this instance, the existing forms based authentication is replaced with the OpenId authentication from the service in the client's DNZ.

A third option that we're investigating is Active Directory Federated Services, but this is proprietary to Active Directory. The other two solutions support any LDAP based authentication across the internet.

Answer 2

Perhaps this might help…

This vendor, Stormpath, offers a service providing: user authentication, user account management, with hookups to your customers’ on-premise directories.