1

I have to setup a user authentication system which shall be used for more than one application. Coming from Windows background, Microsoft Active Directory came to mind naturally.

But I have heard about OpenId Connect protocol as well. Interestingly, it act as, not only as authentication server but, identity provider server as well. It seems to be default choice for modern day applications.

If I don't have any organization to support, I see no reason to go with proprietary Active Directory.

But yet, I could find nowhere formal comparison between the two. I am not sure if I am making a correct choice.

What could be different considerations which can help me to zero-in on one among those two?

3

The reason you can't find a formal comparison is that you're comparing apples and oranges: AD is a server application while OpenID Connect is a protocol. Consider the following sentences:

  • Clients authenticate to Active Directory using the Kerberos protocol.
  • Clients authenticate to _____________ using the OpenID Connect protocol.

If you want a comparison of Kerberos and OpenID Connect in terms of protocol things like bandwidth used, ease of working with the API, etc, that can be done. If you want to compare Active Directory and _____________ in terms of application things like usability for end-users, flexibility of config for admins, etc, then you'll need to find one or more vendors who sell authentication platforms that support OIDC and compare the application as a whole to Active Directory.


One obvious point that I'll throw in is that OIDC vendors tend to be focused around "single sign-on" or "authentication-as-a-service" meaning that they are cloud-native, integrate easily into all kinds of websites, and someone else takes care of the datacentre part. That said, I think Azure AD also does all of those things, while being a full Active Directory ...

  • I was aware that OpenID Connect is a protocol and not implementation. Ok, to be specific, how would you compare AWS Microsoft Active Directory to CloudFoundry UAA? My all applications are cloud based. So even my authentication server is going to be hosted on cloud. My end-users need not to belong to single domain. – Manojkumar Khotele Oct 25 '18 at 5:13
  • @ManojkumarKhotele I've never heard of CloudFoundry UAA before, but googling for "cloudfoundry uaa azure ad" it looks like you can use UAA to add an OAuth, OIDC, or SAML layer in front of AD, so again, they're not directly comparable. The question is going to come down to: are your "cloud based applications" easier to set up using OIDC rather than talking directly to an AD? – Mike Ounsworth Oct 25 '18 at 11:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.