I work in an environment where I have to use my LDAP ID+pass for running various applications as admin, sending emails, or for letting the application access the internet and so on..
A short list of the apps and where my password lies in them :
- SONAR - in the config file
- Nexus - entered in the application (get encrypted in the config file)
- SVN - a cleartext in a properties file
- JIRA - secured in the user database
- Jenkins - entered in the application UI - my SVN password - masked , my Jenkins password - secure, my JIRA password - masked , my Nexus admin password - encrypted and maybe a few others might be added.
Now my password is visible to your average inquisitive user via configuration files, in some unprotected logs, or just plain in sight in the application UI. So I have 3 problems
A. My personal password privacy
B. Users having indirect access to the common master/admin password for many apps.
C. Scope of my password getting locked by repeated attempts etc.
Currently I get by, by working this problem at the level of each application- encrypting/masking the password or restricting access or some other recommended means.
What I am looking for
Panacea. Am I missing something somewhere by doing it per application and making it complex ? Is there a solution available somewhere for this I am not aware of. What is the correct approach to this problem I think would be pretty common ??
- There is no SSO
- Mix AIX+Windows environment using LDAP, AD (and maybe oauth, I am not sure)
- The organization does not allow for a dummy/user-independent ID to be created which will take care of problem A.