Group items tagged

OpenAM centralizes authentication by using a variety of authentication modules. Authentication modules connect to identity repositories that store identities and provide authentication services. The identity repositories can be implemented as LDAP directories, relational databases, RADIUS, Windows authentication, one-time password services, other standards-based access management systems and much more.

OpenAM centralizes authorization by letting you use OpenAM to manage access policies separate from applications and resources. Instead of building access policy into a web application, you install a policy agent with the web application to request policy decisions from OpenAM. This way you can avoid issues that could arise when developers must embed policy decisions into their applications. With OpenAM, if policy changes or an issue is found after the application is deployed, you have only to change the policy definition in OpenAM, not deploy a new version of the application. OpenAM makes the authorization decisions, and policy agents enforce the decisions on OpenAM's behalf.

An authentication service confirms the identity of a user or a client application.

OpenAM is most frequently used to protect web-accessible resources. Users browse to a protected web application page. An agent installed on the server with the web application redirects the user to OpenAM for access management. OpenAM determines who the user is, and whether the user has the right to access the protected page. OpenAM then redirects the user back to the protected page, with authorization credentials that can be verified by the agent. The agent allows OpenAM authorized users access the page.

Joel, we chose consul for a few reasons. First, I wanted a service discovery solution that could work with our legacy architectures as well as any new projects we run on mesos. In addition, I wanted a way to bootstrap the mesos cluster setup/configuration (masters and slaves) such that when they are provisioned, they will be auto-configured using data in consul. Think zk values, quorum, etc. I’ll be working on a solution for this very soon. Lastly, I really like how consul supports health-checks, which we will leverage heavily to ensure that only “healthy” services are actually registered. Like you mentioned, consul is very fast in updating the service info and that is very important as well. Hope that helps, -Phil