An Introduction to Interoperability Challenges in the Modern Enterprise

Have you ever purchased a new dishwasher? For those of you who have, you know that the dishes don’t get washed until your “purchase” is picked-up/delivered, the old dishwasher is removed, and the new unit is hooked-up. In fact, until the new dishwasher is hooked-up, it simply doesn't work. The dishwasher can be smart, stylish, noiseless, and/or energy-efficient... but none of this matters if it’s not properly connected. At the end of the day, if you want to enjoy the luxury of automatic dish washing, one thing is clear: your new dishwasher needs to be hooked-up.

The act of hooking-up a dishwasher is not unlike adding a Linux system to an existing enterprise IT environment. When you deploy a Linux system, it too needs to be “hooked-up”. As the data that flows through your environment consists of different kinds of objects (e.g. users, groups, hosts, and services) the associated identity information is not unlike the water in your dishwasher. Without this identity information

(or, in the case of the dishwasher, without the water) your new machine is less than useful. Ensuring that your new system (or new dishwasher) is properly connected is important, if not essential.

Identities interact with resources and systems and to interact properly identities need to be authenticated and policies need to be applied so as to determine what these identities are actually entitled to do. Identities can represent people (e.g. employees who interact with applications as deployed within the enterprise) or systems and services that interact with each other in an automated fashion.

For a given person, system, or service to establish its authenticity, an identity needs to have some form of credentials (e.g. a password or a key) and must use these credentials as proof that it is (in fact) who it claims to be. Credentials themselves need to be treated as secrets so as to ensure that different identities are unable to impersonate each other. A prudent approach to protecting this information can be found in storing credentials in a central database that has additional ways and means to prevent such sensitive information from being exposed.

The Lightweight Directory Access Protocol (LDAP) provides a way of storing identities and their related credentials and to perform authentication. There are many open and closed source implementations of the LDAP standard. One of the most popular LDAP-based solutions in the modern enterprise is Microsoft Active Directory. By some estimates Active Directory (AD) is deployed in more than 90% of enterprises. AD became popular because it provides a convenient way of managing different identities, credentials and performing authentication. That said, it is not solely an LDAP server; AD also includes a Kerberos server and a DNS server (see image below). This additional functionality enables AD to perform Kerberos based authentication and single-sign-on. Having DNS as a part of the same solution makes managing Kerberos much easier.

AD has been available for more than a decade and over time it has become the center of many environments. A lot of services and products have been built to rely upon, integrate with, and even assume the presence of AD.

Linux systems installed in the enterprise environment face the challenge of interacting with AD. Unfortunately, Linux and AD are built around different representations and assumptions with respect to the identity of objects; this makes the integration of Linux systems into AD environment somewhat complex.

Returning to the dishwasher analogy, let's imagine that you have purchased a new machine with an inlet valve that expects a 12 mm fitting instead of the more traditional half-inch. What do you need? You need an adapter. In the world of dishwasher installation, this is a relative “no-brainer”... you simply buy an adapter (...it’s likely co-located with the dishwashers at the store). This “fix” works quite well – especially if you have only one device. But once you have several utilities that each expect a pipe of another size, it might be easier (and cheaper) to connect them all to the pipe they expect and then connect that pipe to your water supply. Using this latter approach, you would need to have only one place where an adapter would be used to bridge between the two types / sizes of pipe.

As with the dishwasher example there are multiple ways to connect Linux systems to AD. Generally, the options fall into two different categories: direct integration and indirect integration. In a series of future blog posts I will explore these options in greater detail – be sure to check back soon.