This document introduces whada, a multi-protocol authentication and authorization tool that allows managing user privileges and permissions through an LDAP backend. It addresses the need for centralized authentication across internal web services while overcoming the limitations of traditional directory services like ActiveDirectory. Key points are that whada stores authorization data in its own privilege store and retrieves authentication data from external sources like LDAP, with the goal of allowing dynamic management of user access without worrying about password storage. The document outlines whada's architecture and implementation as an OpenLDAP backend module written in Perl, and solicits feedback on potential next steps.

1. whada
YAPC::Asia 2011
2011/10/15
tagomoris
2011 10 15

2. 2010/08 livedoor
System Administration Group
Develop Support Group
2011 10 15

3. 2011 10 15

4. what's WADA ?
2011 10 15

5. WADA Pass
( )
2011 10 15

6. what's whada ?
2011 10 15

7. whada
'Whada Hits on the Advanced
Dominant Authentication.'
Multi-Protocol
Authentication/Authorization
Tool
2011 10 15

8. whada
Multi-Protocol
Authentication/Authorization
Tool
(Now, LDAP only... )
2011 10 15

9. Why whada ? (1)
Many internal web services requires
authentication/authorization.
Authentication per services:
chaos
management worry
poor UI
2011 10 15

10. Why whada ? (2)
Password dictionary is very sensitive
and dangerous:
new commers
retired employees
password changes
2011 10 15

11. Why NOT
ActiveDirectory ?
Managed by personnel department...
We cannot :
change data structures
add attirubutes
normalize values (!)
add ACL rule (!)
2011 10 15

12. Why whada ? (3)
We want to:
add/drop new privilege definitions
add/drop permission to/from anyone at
anytime
ignore password management
use web centric authentication protocols
2011 10 15

13. whada
authorization data source:
by whada privilege store
authentication data source:
external data source (ex: LDAP)
client access protocol:
LDAP (OpenID/OAuth comming soon!)
https://github.com/tagomoris/whada
2011 10 15

14. whada data
Account: Account Name
Privilege: Label for Authorization
(ex: WHADA, BLOG, BLOG+ADMIN, ...)
2011 10 15

15. 2011 10 15

16. slapd perl backend
Backend module runs in
OpenLDAP Server (slapd) process
specified Perl Module.
database perl
suffix "dc=wada,dc=intranet"
perlModulePath /root/whada/lib
perlModule Whada::SlapdBackendHandler
2011 10 15

17. 2011 10 15

18. What i should do next ?
OpenID / OAuth
Improved Admin UI
Other password data source?
(NIS? RDBMS?)
Performance?
2011 10 15

19. Thank you!
2011 10 15