@oliof@octodon.social This sounds reasonable except the gap i see is by using LDAP and not a public key server there is no way for people outside of the company to know whos key to trust that claims to be part of the company.

For example if someone in the company posts some software, or a letter or any conntent and an external user wants to see if they should trust them as a representative of the company and ensure they arent just an employee but authorized to validate releases or make particular decisions, how would they do that?

@freemo @oliof SSO is the Identity Provider (IdP) and LDAP is the Data Store layer, managed by an Identity Manager (IDM). LDAP shouldn't be exposed publicly, but SSO and key servers with data sources managed by an IDM are.

@vwbusguy

So what software represents the IDM here?

@oliof@octodon.social

@freemo @oliof FreeIPA is a good one:

https://www.freeipa.org

@vwbusguy

Can you give me a breakdown in your mind of what software fills all the roles in an open source company... Who is the IDM, the identity provider, what software does the SSO, the LDAP, etc... specifically solutions that would work well with open pgp...

Checking out free ipa now.

@oliof@octodon.social

@freemo @oliof That really depends on your org. Last place where I was the Identity Architect, the IDM was internally built. The LDAP was a mix of OpenLDAP and Active Directory that was managed by that IDM tool and Grouper, from common sources. The Identity Provider for SSO was handled by both Apereo CAS and TIER's Shibboleth, and LDAP was also the authentication and authorization source for sssd logins, sudo, etc.

@freemo @oliof Many, many years ago (and multiple employers ago), I gave a talk on this at the So Cal Linux Expo:

https://www.socallinuxexpo.org/scale12x/presentations/cas-and-shibboleth-open-source-your-identity

@vwbusguy

Thanks, all very helpful. I will be rethinking my original plan which was admitidly much simpler.

@oliof@octodon.social

@freemo @oliof Much simpler might be better. I was managing identity for an org with hundreds of thousands of entities. If that's not where you're at, you might not need something as elaborate, but the concepts are still helpful to understand so you'll have an idea of how to eventually grow and scale your stack.