So sánh ldap và active directory năm 2024

Bước 1 – Tạo các tài khoản tu1, tu2, tu3 tương ứng với các tài khoản trong OU AD, các tài khoản này không đặt mật khẩu.

Tiếp theo ta thao tác trên giao diện admin để config LDAP là Domain controller window server.

Máy chủ AD của mình trong miền là tudv.xyz với IP 103.28.36.64

Bạn nhập vào 1 user đã tạo trên AD để test connection, ở đây mình nhập tu1 => Xác thực test thành công.

Quay trở lại Zimbra server login thử

Với phương thức xác thực này, bạn hoàn toàn có thể áp dụng các policy trong domain với các user, để có hiệu lực với các tài khoản Zimbra.

Ví dụ đơn giản là policy chặn login chủ nhật,hàng ngày chặn xác thực từ 18h-6h sáng hôm sau.Bạn sẽ không thể login vào thời gian vi phạm policy này.

(Lưu ý nếu bạn sử dụng AD trong vùng mạng nào đó, mà sử dụng Firewall, hãy NAT port của AD , và chỉ cho phép IP Zimbra server kết nối đến tại port 389,trong bài LAB này mình sử dụng VPS).

Lời kết

Qua bài viết trên, Nhân Hòa đã hướng dẫn các bạn tạo xác thực các tài khoản zimbra bằng Active Directory, 1 mô hình xác thực tập chung.

However, you might consider them very similar to each other because Active Directory is in fact Microsoft’s implementation of LDAP. Active Directory supports LDAP binding and basic LDAP protocol connectivity. They work together to empower an organization with knowledge and security.

LDAP vs Active Directory – A Synopsis

Service LDAP (Lightweight Directory Access Protocol) Active Directory Functionality LDAP helps in communicating with Active Directory. Active Directory is a database directory system. Supported platforms LDAP is not limited to Windows only but also supports Linux, AIX, Solaris, and HP-UX 11.11. Microsoft Active Directory works on Windows servers. Standard LDAP is an open source. Active Directory is Microsoft’s proprietary. It needs a Microsoft domain controller to function. Flexibility High flexibility Low flexibility Device Management LDAP requires no device management protocol. Active Directory controls Windows devices through Group Policy Objects (GPOs). Philosophy LDAP protocol modifies and queries items in Active Directory. Active Directory is a database-based system that offers many network-related services like authentication, policy administration, user and group management, DNS based services, etc.

To understand the above … differences in details, let’s focus on understanding Active Directory and LDAP’s significance in managing an organization’s identity & access management framework.

What is Active Directory?

Microsoft introduced Active Directory to provide easy and centralized management of users, computers, and other network resources by storing their information in a single directory. It is the most common directory service used by organizations today. Active Directory has two main functions where it allows:

• Users to authenticate and access resources in the domain.
• Administrators to manage permissions and access to these network resources.

Imagining a world without Active Directory will be like providing your credentials repeatedly to sign in to every application and manual labor for the IT team to assign the permissions and access to resources.

Some of the most used Active Directory services are:

• Active Directory Domain Service (AD DS): AD DS stores information about objects in a logical hierarchy and makes it available for administrators and users. For example, information about users is stored as names, locations, phone numbers, emails, and so on.
• Active Directory Federation Services (AD FS): AD FS enables single sign-on for users. With single sign-on, users can provide credentials once and get access to multiple services and applications on the network.
• Active Directory Rights Management Services (AD RMS): AD RMS, as the name suggests, deals with access management of information in a domain. It provides data security by implementing data access policies.
• Active Directory Certificate Services (AD CS): AD CS enables its users to issue and manage Public Key Infrastructure (PKI). It is used for encrypting and decrypting files, emails, and network traffic on a domain.
• Active Directory Lightweight Directory Services (AD LDS): AD LDS is an LDAP directory service that supports directory-enabled applications. It does so without any domain-related restrictions and dependencies on Active Directory Domain Services (AD DS). AD LDS runs on stand-alone servers or member servers.

Why should you Consider Active Directory?

If you are working in an environment based on Windows and Microsoft, Active Directory turns out to be the best choice. With the Active Directory console, network management tasks become easier for administrators in several ways, such as:

• Active Directory stores network data and helps in organizing your company’s hierarchy.
• Active Directory can operate in multiple domains with different security policies and administrators.
• It wisely manages authorizations, making sure that files are accessed only by those who have access to them.

Alternatives to Active Directory

There are a few alternatives that administrators can consider if they do not wish to use Active Directory. One such alternative is OpenLDAP. It is somewhat of a free, open-source alternative. Do not confuse it with LDAP. OpenLDAP is more than just a protocol.

OpenLDAP is a directory service but does not match the feature level of Active Directory.

• Active Directory includes certain features such as Group Policy Objects for Windows.
• OpenLDAP only uses LDAP as protocol while Active Directory supports multiple protocols including LDAP.

On the other hand:

• Active Directory is clearly more efficient, but OpenLDAP’s focus on LDAP gives it greater depth as compared to Active Directory.
• OpenLDAP is customizable and offers greater flexibility.
• Active Directory comes with a lot of maintenance and hardware costs, which makes sense since it is feature rich. OpenLDAP, on the other hand, is free.

With so many advantages, organizations mostly go for a combination of Active Directory and Azure AD. However, there are still some IT companies that choose OpenLDAP because Azure does not support the LDAP protocol for cloud infrastructure.

What is LDAP?

LDAP is a lightweight access protocol used to access and manage directory services. Other complementary protocols include SAML, SMB, Kerberos, OAuth, Radius, etc. For example, with AD FS, you use SAML. Similarly, Active Directory uses Kerberos to manage tokens. Over the years, LDAP has been considerably enhanced to meet the requirements of IT teams.

Historical Perspective

In 1993, Tim Howes along with his colleagues developed LDAP as a low-overhead version of X.500 directory service protocol called DAP. In early 1990s, X.500 was used on limited systems since it was hard on the network (bandwidth intensive) and systems (large footprint). To overcome this, LDAP was introduced that allowed user management and facilitated user authentication to files, applications, servers, and other IT resources with reduced demand on endpoints, bandwidth use, and overhead.

LDAP offers a language for the client applications to communicate to different directory services. In simple words, LDAP is a way to talk to Active Directory. LDAP and Active Directory are just like HTTP and Apache, where HTTP is a web protocol used by Apache.

LDAP Functionality

LDAP provides a simplified directory storage method. It can help add, modify, and delete records. It also facilitates searching records and ensuring user authentication and access to these resources.

There are four major components to an LDAP functionality.

• Update: Adds, modifies, and deletes information in the directory.
• Authenticate: Allows you to bind or unbind to the service. Authentication can include simple credentials or a client certificate.
• Directory structure: Allows you to access attributes of each entry via Distinguished Name (DN), which is used for querying the directory.
• Query: Enables you to search and compare the information in the directory.

LDAP Authentication

To keep your data secure, LDAP offers two main authentication types.

• * ### Simple Authentication:

  Simple authentication is widely used as it is pretty simple. All you need is a distinguished username and password for authentication. It just requires you to send the name and clear text password of the client to the server. However, there is a security downside to this authentication type. The authentication data is available on the network to read, which puts users at security risk. Organizations can avoid such scenarios by utilizing simple authentication within an encrypted channel that the LDAP server supports.

  • SASL (Simple Authentication and Security Layer) Method:

    To enhance security, there is another authentication method called SASL. It binds an LDAP server to other authentication mechanisms, for example Kerberos. The LDAP server then sends the message in clear text to other authorization service. This makes your directory less vulnerable to malicious attacks.

LDAP Query

LDAP queries are the commands used to retrieve information from a directory service.

For example, if you want to view the expired user accounts in Active Directory, you can use the following LDAP query:

(&(objectCategory=Person)(objectClass=User)(!accountExpires=0)(!accountExpires=9223372036854775807))

Similarly, if you want to see the groups that a particular user is part of, you apply the following LDAP command:

(&(objectClass=user)(sAMAccountName=yourUserName) (memberof=CN=YourGroup,OU=Users,DC=YourDomain,DC=com))

How Active Directory and LDAP Work Together

LDAP is the core protocol that allows Active Directory to perform all the directory access services, including Active Directory Service Interfaces (ADSI).

• LDAP facilitates searches in Active Directory. If a user wants to search a computer or a group in Active Directory, LDAP performs the search and fetches the results.
• Users get access to information based on multiple levels of permissions on Active Directory through LDAP authentication. LDAP administrators have elevated permissions to add or remove information from Active Directory.

How does LDAP Limit Data Breach Threats in Active Directory?

Active Directory is a prized target for external security threats. If a hacker gets access to even a single account, sensitive files can be at risk. And if the account is an administrator account, the extent of damage could be unfathomable.

This is where LDAP steps in as a savior. Organizations can use any of the LDAP authentication methods as a strong defense against such security threats.

• They can use an encrypted channel supported by the LDAP server to avoid exposing any passwords.
• They can even switch to the more advanced SASL method which decouples authentication mechanisms from application protocols, making it tightly secure.

How do LDAP Queries Work in GroupID?

LDAP queries help in accessing data from Active Directory. If you have GroupID with you, this process becomes much easier. GroupID provides a GUI-based management console to interact with the directory.

In GroupID Automate and Self Service, when you create a Smart Group or Dynasty, you assign some rules for the membership of these groups. GroupID translates these rules into an LDAP query. When executed, this query retrieves records from Active Directory and updates group memberships. You do not need to apply the queries every time you need to update group memberships.

GroupID further allows you to limit the search scope for security roles in Active Directory with LDAP queries. For example, you can set the LDAP filter to “Country=United States”. When a role member performs a search, GroupID retrieves only those objects from Active Directory whose Country attribute is set to the United States.