Question: Future integration with LDAP?

[erickrodriguessp]

Hello everyone!
First, I just want to say that Remotely is an awesome project, it will solve a lot of problems for the small business / single IT maintenance guy in a company, specially in these worldwide pandemic days.

I just have a question: is there a way, or a future feature of Remotely, to add LDAP authentication, at least for the agents that will provide the support? I think that this will be a very important feature.

I'm not a developer, so I was thinking to make a "botch", using SQL Server as a middle way to connect to LDAP, but I'm aware that will be a huge security risk involved, so, if someone have any ideas, please...

Thanks for everyone that is contributing with this project!

[bitbound]

Thanks for the feedback! :)

I'm currently working on a major rewrite of the server UI. After that, I have plans to work on the Mac agent, then several automation features (e.g. scheduled scripts).

After that, I might be looking for other features. It's hard to tell what will take priority at that point, though. Between my real job and family, there's often little time and energy to spare. So I need to choose my efforts wisely. :)

However, this could be worth investigating in the future if enough people want it.

What level of integration are you thinking? Just to authenticate and authorize a tech to login, such as against a single AD membership group?

Or are you thinking granular permissions via group memberships, device groups that sync with AD, etc?

[stevesobol]

I just deployed Keycloak and want to eventually integrate it with Remotely - I have already set up Nextcloud and Mediawiki (actually, in the process of setting up Mediawiki) to authenticate against Keycloak using OpenID connect, and I have plans to use it with other websites and web-based services I set up in the future. I THINK, though I'm not sure, that there's a .NET authentication framework that can handle multiple types of authentication, including various flavors of SSO and other auth types like LDAP.

This is something I'd be very willing to contribute time on.

[bitbound]

@stevesobol You're correct. I'm using Microsoft's Identity framework to handle user accounts. They have middleware for using external OAuth and OpenID authentication providers, and they have pre-made libraries for some providers (documentation here).

I'm not sure if they have anything for LDAP, though. It might be necessary to roll your own provider middleware using the DirectoryServices APIs in Microsoft.Windows.Compatibility. If anyone has additional info, please share. :)

Setting up simple authentication shouldn't be too challenging. I think the complexity would be in adding user permissions for various features (since it's not programmed yet), syncing those with external provider claims, being able to switch between external and current provider mechanisms, and abstracting feature permissions so they work with any provider used.

This would be new territory for me, so I'm not sure what the full scope and complexity would be.

[erickrodriguessp]

Thank you so much for your reply!

Like I said earlier, I'm not a programmer (I wish I was one...), but I imagine that there is a way to use a library that handles the LDAP authentication, like this one: https://github.com/hgdiaz/aspnetcore.ldap or https://github.com/dsbenghe/Novell.Directory.Ldap.NETStandard

My idea on this LDAP Authentication feature, comes from the own advantages of SSO, like central user management, access control, security, password rotation and complexity requirements, etc.

The company that I work for, only uses applications that integrates LDAP: inventory management, firewall, antivirus management, the corporate Office 365... etc. just because of the advantages of LDAP.

The scope that I see the use case of this is simple (though I don't know the complexity to implement this).

Lets supose that there is 5 agents in a company (people that provide remote support).
If we create a "User Group" or OU (Organization Unit) that includes those 5 agents, then we can tell to Remotely that these users have access to the application. If a user tries to login and doesn't belong to this group, then it's "Access Denied".
If one of this agents moves to another position in the company, just remove him from the group.
If an agent doesn't work anymore for the company, just delete the user or deactivate the user from the company's Active Directory.

For starters, let's say that everyone in this group have the full access to everything in Remotely, just to enable this feature.
Later, it could apply like user groups that has different access permitions.

I'm really sorry for my bad english, it is not my native language, so probably there is some spelling errors or some things that can be misunderstood. The truth is that I want to contribute, even if I don't have the knowledge to write a single line of code.

Again, thank you so very much for the development of Remotely!!!!

[erickrodriguessp]

Replying:

I'm currently working on a major rewrite of the server UI. After that, I have plans to work on the Mac agent, then several automation features (e.g. scheduled scripts).

I just saw the new UI for Remotely and it looks fantastic! :-)

After that, I might be looking for other features. It's hard to tell what will take priority at that point, though. Between my real job and family, there's often little time and energy to spare. So I need to choose my efforts wisely. :)

Totally understandable. Family comes first, and I'm glad that you sir, made this decision. :-)

However, this could be worth investigating in the future if enough people want it.
What level of integration are you thinking? Just to authenticate and authorize a tech to login, such as against a single AD membership group?
Or are you thinking granular permissions via group memberships, device groups that sync with AD, etc?

That's the thing that I've spent so many time to explain above that was really simple to describe in the first place! :-P
I think that just to authenticate the agent (or tech) to login will suffice, at least for now.
If there is enough demand to add more complex stuff, like you said earlier, it could be done later, because I think that will be way too complex and not everyone really needs (or uses) this kind of complexity.

Thanks again!

[KnightNFS]

i am also interesting in SSO / Costume OAuth( OIDC )
This kind of integration would be useful for your project, I would use them

[efla83]

UP : J'aimerais tellement une authentification SSO ou actice directory. ce serais tellement bien. Votre outils Remotely est simple et efficacen. il manque jsute une fonction d'authentification. Est-ce possibLe ?

MErci encore pour le travail