Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

5
  • 1
    As the name implies, LDAP provides directory services. Its primary use is to store information about people, computers, services, as so on. It can be used for authentication (e.g,, implicit using an LDAP bind or matching a raw password hash in userPassword), but it doesn't have to be. Is the intent just to get away from LDAP as an authentication source? Or is your organization trying to get out of the business of running a directory altogether? Commented Sep 8, 2021 at 15:35
  • First, document all the uses of LDAP at your organization, then plan replacements for each, design solutions, then write code. Implementation via Whack-A-Mole is suboptimal. Commented Sep 8, 2021 at 18:58
  • @JamesSneeringer The later. It just so happens the authentication and especially user information (which users exist, their groups, homes, shells, ...) is really hard to replace. The other info in ldap is used only in places easily customisable, like by web-backends or our DNS+DHCP system, so I managed to point those to webapis effortlessly. Commented Sep 9, 2021 at 16:23
  • @waltinator you're right, thats actually what I did, I phrased the question vaguely in case there is some nice all-in-one replacement. That would be great of course, but I really only need a good solution for nss and possibly pam (so something for sssd would work too), the rest is already taken care of. We have a ton of custom software, so most is very easy to point to anything, I only used oauth2 because I thought it would make my work and that of my successors easier. Commented Sep 9, 2021 at 16:30
  • 1
    The only other reasonable NSS replacement for Unix account information is NIS, and I wouldn't recommend going down that road. LDAP is the industry standard for this. It's also worth distinguishing between running LDAP as a commodity service (with your own apps built on it), and running a service that happens have an LDAP component for its own private use. You may want to take a look at FreeIPA (or Identity Management with RHEL), which is the latter. It has some support for migrating account data from other LDAP directories, which may simplify things for you. Commented Sep 9, 2021 at 17:35