WebSSO

Custom IdP implementation supporting SAML 2.0, OAuth 2.0, Open ID Connect checking login relationship of user and service based on aeSrvGroup - aeLoginGroups.

Python modules to be used: pysaml2, oic, pyop

PKI

X.509

Issue server certs to aeHost, aeNwDevice, aeService or aeSrvGroup based on authorization of role Setup Admins
see also LDAPcon 2017 talk: X.509 PKI RA schema for Æ-DIR
direct ansible integration for server cert enrollment
X.509 cert enrollment for aeUser with multi-factor authc
remote CA keys (e.g. based on pyeleven and PyKCS11)
Are there ready-to-use PKI backend solutions in Python?
- certidude

DevOps tooling

Scripts for local slapd-ldap instance used as admin proxy for bulk operations from local tools.

ansible

Automated authentication configuration (add entry, set userPassword) for aeHost and aeService with an ansible module.
Dynamic inventory plugin for accessing attributes in Æ-DIR entries

Logging

Log performance data as Graylog Extended Log Format (GELF)
The web applications should use Python's logging module and file ae-logging.conf
Add cee_syslog_handler in file ae-logging.conf

PXE/DHCP/TFTP integration

Extend one of the following Python demon implementations to look up correct boot config in Æ-DIR:
- ptftpd (GPLv3)
- PyPXE (MIT License)
make use of aeNwDevice

Network Access Control (NAC)

RADIUS

Support for RADIUS with dynamic RADIUS client configuration (see also NAC).

FreeRADIUS: has many features, basic LDAP authc out-of-the-box
BSDRadius: needs own module
thin implementation based on pyrad

DNS

use PowerDNS to serve attributes as DNS RRs to augment regular DNS service:
- aeHost (A and PTR)
- aeNwDevice (A and PTR)
- aeZone (SOA)
use remote backend (preferrably with DNSSEC) via pdns-remotebackend-python

User Interface

specific web application for administrative use-cases
falcon with Jinja2
Simple reporting use-cases (expired objects etc.).
Graph reporting of data structures in a zone.

ModSecurity

Define a ruleset for ModSecurity.

Command-line tool

Consolidate various command-line tools into one tool with sub-commands within Python module package aedir.
Implement following use-cases:
- Add aeHost entries
- Set password (replace ae-passwd.py)

Browser integration/security

Make use of Subresource Integrity either with ansible-generated hashes or on-the-fly-generation in the web app(s):

Python 3.x

Use falcon with Jinja2 for the simple web apps
Port modules ldap0, slapdsock and aedir

Compliance checks

Prepare compliance statements: