OpenLDAP to proxy for AD FS

Question

I have AD FS setup in EC2 and its working fine (w.r.t the basic test I did below) (domain names are test ones and not real)

Is there a way for OpenLDAP (or anything else) to behave like a proxy to speak with ADFS? Some of the Services dont have the ability to connect with ADFS (in open source version eg. https://grafana.com/docs/grafana/latest/auth/saml/)

Also ADFS is unavailable at dev, test environments (that only have Linux) and there is no ADFS that is available OpenSource that I could use.

So I was think to if we could use LDAP as proxy. any thoughts?

Like App1 speaks to Server1:LDAP which in turn speaks to Server2:ADFS, such that App1 need not be compatible with ADFS

I did find some samples to connect with AD,

BUT my LDAP Bind fails, hinting that ADFS does not work with LDAP Query

ldapsearch \
    -x -H ldap://HOST_IP \
    -b dc=sometest,dc=com \
    -D "cn=sometest_user,dc=sometest,dc=com" \
    -w SECRET

ldap_bind: Invalid credentials (49)
    additional info: 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580

Update: Keycloak is the way to go (IF you dont have ADFS at dev/test environment). Obscures out the ADFS layer from code. (still testing out keycloak)

Yes, just set it up with the LDAP back end. There are several variations. Off topic. — user207421, Feb 25 '20 at 20:36
Does this answer your question? [AD vs ADFS vs LDAP: Explain it like I'm 5](https://stackoverflow.com/questions/51006871/ad-vs-adfs-vs-ldap-explain-it-like-im-5) — identigral, Feb 26 '20 at 01:30
I understand the difference, I am trying to find an equivalent to: https://wiki.samba.org/index.php/OpenLDAP_as_proxy_to_AD for ADFS Like App1 speaks to Server1:LDAP which in turn speaks to Server2:ADFS, such that App1 need not be compatible with ADFS — Srinath Ganesh, Feb 26 '20 at 13:31
OpenLDAP does not speak the same protocols as ADFS so the answer is no. — identigral, Feb 26 '20 at 22:21
ok thank you. so if i understand, Ldap to AD is possible but not to ADFS — Srinath Ganesh, Feb 27 '20 at 12:38

score 1 · Accepted Answer · answered Feb 27 '20 at 18:15

LDAP is a protocol used to access LDAP's e.g. AD.

It is not federation which is something ADFS requires.

ADFS works with:

WS-Federation
OpenID Connect
SAML

So LDAP cannot replace ADFS.

However, ADFS can use LDAP for authentication.

If you want an open-source ADFS replacement, you could have a look at EmbeddedSTS as long as you are happy using WS Fed.

OpenLDAP to proxy for AD FS

1 Answers1