Re: AD or ADAM as a user database

BizTalk Benjamin wrote:
Hi, I'm working on a pretty standard piece of functionality at the moment attempting to design a user repository. . This repository should hold all the registrations of people visting a website and will contain names, addresses, user names, passwords, mappings to other back office system references etc. The repository itself will be accessed via web services.

Now i've been reading some articles which recommend that LDAP and specifically ADAM would be the best way to proceed instead of basing this on a relational database. I looked up some stuff on ADAM and ASP.NET and all the articles seem to talk only about Roles and membership and dont say anything about using it as a database.

I think You have read about using AzMan and role based authorization with ADAM under the hood - that's why You've got impression that this is only way to do this.
Of course authorization should be based on something - it may be based on different things, especially if You are building You authorization mechanism on Your own. Using group membership is nice and easy way to do this.

No - You should not treat ADAM same as a database, it is directory.


Does anyone in this newsgroup have any comments on this? Can we use AD or ADAM for my requirements or would it be better to just build a relational DB?

If You need to create repository of a users for purpose of authentication and authorization ADAM or AD would be a good tool. Rather ADAM as I see Your scenario as a repository with custom schema for custom application on web only.

ADAM will let You define Your own schema (You can use existing schema as a base) and define own security in directory. Then You can create objects and fill it with attribute values - that's how You can store Your data in LDAP directory, and of course retrieve them as well :).

What is missing in ADAM is Kerberos authentication, which is present in AD. But You can easily implement authentication based on simple LDAP bind or digest authentication in Your application. If You are interested in SSO for Your users You may incorporate also some federation technology (like ADFS for example) into Your app's world.

I think that You may find this site:
http://directoryprogramming.net/

and these blogs:
http://www.joekaplan.net/
http://dunnry.com/blog/

interesting.


Probably few other person will drop something in this thread with more information.



--
Tomasz Onyszko
http://www.w2k.pl/blog/ - (PL)
http://blogs.dirteam.com/blogs/tomek/ - (EN)
.

Relevant Pages

  • Re: ADAM - SSO and provisioning considerations
    ... ADAM and "custom" security principals and gives you ... for authentication, where you might ship some default providers (ADAM LDAP ... be used to link up to the authorization store. ... > customer's identity store is a non-MS directory, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Offloading authorization to ADAM
    ... authorization, what is the application that is requesting the authorization. ... authorization and you want to store the roles as groups in ADAM? ... "user groups have to be returned from ADAM" ... authentication, with this AD part is over. ...
    (microsoft.public.windows.server.active_directory)
  • Re: customer authentication center
    ... The idea is to merge all login info into one secure repository. ... customers will be able to use single login for all web sites, ... Is MS ADAM appropriate for this task? ... If there is no any integration then some additional module/delegate must be implemented to route authorization request based on type... ...
    (microsoft.public.windows.server.active_directory)
  • Re: AD or ADAM as a user database
    ... attempting to design a user repository. ... specifically ADAM would be the best way to proceed instead of basing this on ... Of course authorization should be based on something - it may be based ... authentication and authorization ADAM or AD would be a good tool. ...
    (microsoft.public.windows.server.active_directory)
  • Re: ADAM Proxy Bind re-direction
    ... Lee and Joe, ... You are right - I am creating an ADAM ... repository to be used as a shared Identity repository / Identity publishing ... the upside (over password sync) is: ...
    (microsoft.public.windows.server.active_directory)