We have a Saas offering that is hosted within our own data centers. Our software offering utilizes OpenLDAP as it backing for token auth security. Our operations team has asserted that for PCI compliance our software needs to store those credentials in the same Active Directory that they use for our internal users. Their argument is that for PCI compliance you need a central authentication server for all authentication. Can someone please explain what they are referring to or share more light on the subject?
The most direct way to understand their claim would be to ask them to provide you with specific references to this requirement in the PCI Data Security Standard (DSS). Otherwise we're taking shots in the dark to try to confirm or deny their statement.
I'm not aware of any requirement for having a single authentication system, let alone single server, in a DSS compliant environment. I did review the requirement 7 & 8 sections of the DSS and confirmed those two in particular don't say anything about needing a single authentication system. Requirement 7.2 does say "Establish an access control system(s) for systems components ...", but that doesn't support their argument even if you consider 'authentication systems' and 'access control systems' to be interchangeable.
Section 10 does talk about centralized logging, so that could be their reason for concern if their goal is for all user authentication to be logged in the AD. But centralized logging doesn't require you to use a centralized authentication store either. Your LDAP server could log the relevant security events to a central store if needed.
Finally, they may not be requesting consolidation due to any specific requirement in the DSS but instead their business requirement to keep the environment as simple and limited as possible. Since each new server or component needs to meet compliance requirements they may not want to be responsible for yet another authentication system. With your SaaS offering already in place that doesn't seem like reasonable restriction, but you'd have to negotiate with them to hopefully come to that conclusion.
There is nothing in the PCI DSS that explicitly requires centralized authentication. By contrast, logging is required to go to a centralized server (§10.5.3).
Your operations team may be mistaken, or they may be interpreting. Many of the requirements around authentication (e.g., failed login detection) are more easily performed with a single centralized authentication store. I would ask them to document whatever clause of PCI DSS they feel imposes this requirement, then you can discuss it with them more fruitfully.