我正在帮助一家典型的小公司，该公司以几个外包系统（谷歌应用程序、svn/trac）开始。 添加了一个内部 jabber 服务器（ejabber 主要用于 iChat 客户端）。 订阅一些网络服务（例如 highrisehq）。 并且有 pfsense freebsd 防火墙提供的 VPN 服务。
所有这一切的最终结果是他们被密码和帐户淹没。
看来，如果他们有一个统一的登录/单点登录服务，他们可以在将这些服务结合起来方面走很长的路。 例如：ldap 作为主存储库，连接到它的 radius 用于 vpn、ejabber 甚至 WPA2 无线访问、用于 google 应用程序登录的插件，也许还有用于 highrisehq 等外部网站的 openid 服务器。
似乎所有这些工具都是单独存在的，但是有人知道有一个将它们与漂亮的 GUI 和自动更新结合在一起的盒子吗？ （例如用于防火墙的 pfsense/m0n0wall，用于存储的 freeNAS）。 它不一定是自由和开源软件。 付费盒子也可以。
我想这个一定存在。 Microsoft 的 Active Directory 可能是一种解决方案，但如果可能的话，他们宁愿避免使用 Windows。 ISP 似乎使用各种“AAA”服务器或用于企业防火墙/路由器管理，但这似乎不太正确。
我缺少任何明显的解决方案吗？ 谢谢！
I'm helping a typical small company that started with a couple of outsourced systems (google apps, svn/trac). added an internal jabber server (ejabber for mostly iChat clients). subscribes to a couple of webservices (e.g. highrisehq). and has a vpn service provided by a pfsense freebsd firewall.
And the net result of all this is that they're drowning in passwords and accounts.
It seems that if they had a single unified login / single signon service they could go a long way to combining these. E.g.: ldap as the master repository, radius linked to it for vpn, ejabber and even WPA2 wireless access, plugins for google app sign on, and perhaps an openid server for external websites like highrisehq.
It seems that all these tools exist separately, but does anyone know of a single box that combines them with a nice GUI and auto-updates? (e.g. like pfsense/m0n0wall for firewalls, freeNAS for storage). It doesn't have to be FOSS. A paid box would be fine too.
I figure this must exist. Microsoft's Active Directory is likely one solution but they'd rather avoid Windows if possible. There seem to be various "AAA" servers that ISPs use or for enterprise firewall/router management, but that doesn't seem quite right.
Any obvious solutions I'm missing? Thanks!
发布评论
评论（5）
自从你最初提出这个问题以来已经过去一年多了，所以我猜你现在已经解决了你的问题。 但是，如果其他人对可能的解决方案感兴趣，我建议如下：
首先，我不知道有任何“一体化”解决方案可以解决您的问题。 然而，将三种产品组合起来非常容易，它们可以满足您的所有需求，并为用户管理和密码存储提供单一来源。
要做的第一件事是安装 LDAP 目录来管理用户和组（以及可能超出您问题范围的其他对象）。 这可以是 OpenLDAP、Apache DS、Microsoft Active Directory 等。基本上任何 LDAP 服务器都可以。
其次，我建议使用 FreeRADIUS /l-radius/" rel="nofollow noreferrer">LDAP 目录配置 作为后端服务。
第三，获得 Atlassian Crowd 的许可证。 它提供 OpenID 和 Google Apps 身份验证。 最多 50 个用户的价格从 10 美元起，无限用户许可证的价格最高可达 8000 美元。
三者的安装和配置都相对容易。 您可能会将大部分工作投入到创建用户和组上。 您可以在一台服务器上安装所有三个组件，最终得到一个盒子，允许您验证几乎所有内容，从桌面登录、通过 Google Apps 和其他 Web 应用程序，到 VPN 甚至交换机、WiFi 和路由器登录。
只要确保明智地配置您的角色和组即可！ 否则，您最终可能会遇到一些销售人员能够对您的防火墙和路由器进行管理:-)
It's been over a year since you originaly asked the question, so I'm guessing you've solved your problem by now. But if someone else is interested in a possible solution I suggest the following:
First of all, I don't know of any "all in one" solution to your problem. However it's quite easy to combine three products that will solve all of your needs and provide a single source for User management and password storage.
The first thing to do is install an LDAP Directory to manage Users and Groups (and possibly other objects outside the scope of your question). This can be OpenLDAP, Apache DS, Microsoft Active Directory, etc. Basically any LDAP Server will do.
Second I recommend installing FreeRADIUS with the LDAP Directory configured as it's backend Service.
Third get a license of Atlassian Crowd. It provides OpenID and Google Apps authentication. Prices for up to 50 Users start at $10 and go all the way up to $8000 for an unlimited user license.
Installation and Configuration of the three is relatively easy. You'll probably put most work into creating your Users and Groups. You can install all three components on a single Server and end up with a box that allows you to authenticate pretty much everything from Desktop Login, over Google Apps and other Web Apps, down to VPN and even Switch, WiFi and Router Login.
Just make sure you configure your Roles and Groups wisely! Otherwise you might end up with some Sales Person being able to do administration on your Firewalls and Routers :-)
我鼓励任何寻找此类解决方案的人查看 Gluu Server (http://gluu.org)。
每个 Gluu 服务器包括一个用于 SAML SSO 的 SAML IDP、一个用于 OpenID Connect SSO 的 OpenID Connect 提供程序 (OP)、一个用于 Web 访问管理的 UMA 策略决策点 (PDP) 以及一个 RADIUS 和 LDAP 服务器。
Gluu 服务器的所有组件都是开源的（即 Shibboleth、OX、FreeRADIUS、OpenDJ 等），包括用于管理服务器每个组件的 oxTrust Web 用户界面。
对于商业实施，Gluu 将在客户端虚拟机上构建、支持和监控该软件堆栈。
I would encourage anyone searching for this type of solution to check out the Gluu Server (http://gluu.org).
Each Gluu Server includes a SAML IDP for SAML SSO, an OpenID Connect Provider (OP) for OpenID Connect SSO, an UMA Policy Decision Point (PDP) for web access management, and a RADIUS and LDAP server.
All the components of the Gluu Server are open source (i.e. Shibboleth, OX, FreeRADIUS, OpenDJ, etc.), including the oxTrust web user interface for managing each component of the server.
For commercial implementations, Gluu will build, support, and monitor this stack of software on a clients VM.
您可能不想在如此多的应用程序（尤其是外部应用程序）中标准化密码，但对于内部应用程序来说，使用 LDAP 等身份验证服务是有意义的。
eSSO 解决记住密码的问题
您可以使用 Novell SecureLogin等 可能对 Novell Access Manager 和 Novell 身份管理器
You may not want to standardise passwords across so many apps (especially external ones), though for internal ones using an auth service like LDAP makes sense.
You could solve the issue of remembering passwords with an eSSO like Novell SecureLogin
Also you might be interested in Novell Access Manager and Novell Identity Manager
我也可以使用这样的设备，但是我能找到的唯一设备是来自 Infoblox 的一份（可能已经过时的）数据表。 他们似乎从此专注于自动化网络管理，但我在他们当前的网站上找不到 LDAP 设备。 我想用上面提到的 FOSS 东西构建一个 linux 盒子是每个人都会做的事情，但是如果没有电源、磁盘、风扇等就太好了。我想你可以使用像 EEE PC 这样的东西并将配置放在闪存上卡片。
I too could use such a device, however the only one I could find was a (possibly outdated) data sheet from Infoblox. They seem to have since concentrated on automated network managment and I can't find the LDAP appliance on their current website. I guess building a linux box with the FOSS stuff mentioned above is what everyone does, but it would be great not to have power supplies, disks, fans etc. I suppose you could use something like an EEE PC and put the config on a flash card.
这也是我一直在寻找的东西， http://www.turnkeylinux.org/openldap 看起来就像解决方案：“设备”安装，它包括加密的在线备份，可以轻松恢复到新的或替换的机器上。
This is something I was looking for as well, and http://www.turnkeylinux.org/openldap looks like the solution: "appliance" installation, and it includes encrypted online backup which is easily restored to a new or replacement machine.