Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance and reliability". Ultimate goal is to enable SPNEGO for single-sign-on within the domain.
Previously, we happily used Apache's mod_authnz_ldap. nginx however does not even seem to support authentication modules by default. I never worked with nginx before, so I might have missed something.
Asking local experts about this, I received the response "The HTTP server should not do the user authentication – that is the web application's responsibility." So now I am stuck with a bunch of services which were never designed to do user authentication themselves.
This made me think: What are the advantages of not having authentication in the HTTP server?
Performance might be one factor – but at what cost? Usually my stance is "never do it yourself". Especially when it comes to cryptography or – in this case – authentication schemes. Using the HTTP server's features, all authentication is done in one place. User information is simply forwarded to the server-side application. Without such a feature in the HTTP server, I would need to implement the authentication scheme in each and every application over and over again. As of today, I failed to find ready-to-use modules for our ancient php-based applications. There is a kerberos module for flask. It was last updated six years ago and does not play nice with me at all. I have not even looked into the other services yet. It seems to be a massive increase in the maintenance required. I suppose, there are upsides to this approach, but I fail to see the. What are the advantages?