Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Extending LDAP to AWS

0

I’m looking for insights or suggestions with a hybrid identity setup, specifically around access administration for EC2 instances. For newly launched Linux EC2 instances in AWS, we’re exploring ways to leverage existing on-prem LDAP setup, which is populated by Oracle Identity Manager (OIM) based on on-prem AD. The use case is administrative access (not application integration).

Some options I’m evaluating:

  1. Use the on-prem LDAP directly over Direct Connect to authenticate EC2 instance access.
  2. Extend the LDAP directory to AWS (e.g., host a read-replica on EC2) to reduce latency and dependency on the on-prem network. Any other ways to extend this particular LDAP to AWS other than hosting on EC2?
  3. Explore whether this OIM-populated LDAP can integrate with AWS Identity Center?
  4. Options on using AWS SSM with the OIM-populated LDAP?

If anyone has dealt with similar setups or has recommendations on best practices, I’d appreciate any guidance. Thanks in advance!

  • Malini Agrawal
    a month ago

    Are all users that need EC2 access already in Entra ID, or only in the LDAP/OIM setup?

  • Kavz
    a month ago

    The users that need EC2 access is in the OIM - LDAP.

Topics
Security, Identity, & ComplianceCompute
Tags
AWS Identity and Access ManagementAmazon EC2Linux
Language
English
asked a month ago109 views
4 Answers
0
Accepted Answer

For your hybrid identity setup for EC2 instance administrative access, I can provide insights on your options:

  1. Using on-prem LDAP directly over Direct Connect is viable but introduces latency and a dependency on your network connection. If your Direct Connect fails, you might lose access to your EC2 instances.

  2. Extending your LDAP directory to AWS is a good approach to reduce latency and network dependencies. Beyond hosting a read-replica on EC2, you could consider AWS Managed Microsoft AD if your LDAP is AD-compatible. This would provide a fully managed directory service in AWS that could establish trust relationships with your on-premises directory.

  3. For integrating your OIM-populated LDAP with AWS Identity Center, you have a few options:

  • If your LDAP is based on Microsoft AD, you can connect AWS Identity Center to it using AWS Directory Service
  • If your LDAP supports SAML 2.0 and SCIM protocols, you could potentially connect it as an external identity provider to AWS Identity Center
  1. For AWS Systems Manager (SSM) integration with your LDAP, you could:
  • Configure your EC2 instances to authenticate against your LDAP directory
  • Use AWS Identity Center for SSM access, which would then leverage your identity source

Given that you already have Entra ID integrated with AWS Identity Center, you might want to consider whether you can consolidate your identity management approach. If your OIM-populated LDAP is syncing with or connected to your AD (which is then connected to Entra ID), you might be able to leverage that existing chain for EC2 access rather than creating a separate integration path.

The most resilient approach would likely be option 2 - extending your directory to AWS, either through a read-replica on EC2 or by establishing trust relationships with AWS Managed Microsoft AD if compatible with your environment.
Sources
Use Case 5: Extend your on-premises Active Directory to the AWS Cloud - AWS Directory Service
AWS integrate with AD\AAD | AWS re:Post
Connect to a Microsoft AD directory - AWS IAM Identity Center
Workforce identity management - AWS Prescriptive Guidance
Manage an external identity provider - AWS IAM Identity Center

answered a month ago
AWS
EXPERT
reviewed 24 days ago
0

Hi Kavz,

This is a great hybrid identity use case — thanks for sharing the detailed context.

Since you're exploring access administration for EC2 instances via an OIM-populated LDAP setup, here are a few tailored thoughts for each option:

  1. Using on-prem LDAP directly (over Direct Connect): Yes, it can work, but be cautious — this introduces network dependency. If your Direct Connect link goes down, administrative access to your EC2 instances may break. This may be fine for dev/test, but it could pose reliability risks in production.

  2. Extending LDAP to AWS: Hosting a read-replica on EC2 is one route. Another option — if your LDAP is AD-compatible — is to use AWS Managed Microsoft AD and establish trust. This reduces latency and removes the single point of failure from your on-premises.

  3. Integration with AWS Identity Center: Direct integration with OIM-populated LDAP isn’t natively supported, but if your LDAP syncs to AD (which then syncs to Entra ID), you already have an indirect path into Identity Center.

Also worth exploring:

If your LDAP supports SAML 2.0 or SCIM, you could explore custom IdP integration.

AWS Identity Center works well with Entra ID, so consolidating access through it might be cleaner long-term.

  1. SSM + LDAP Access: You can configure EC2 instances (especially Linux) to authenticate via LDAP using tools like sssd and PAM. Combine that with SSM Session Manager and careful role control via AWS Identity Center — and you have secure, auditable, admin access that still aligns with your enterprise directory structure.

Recommendation: If your goal is resilience + manageable latency, extending LDAP to AWS (via replica or trust with Managed AD) is likely the sweet spot — especially if your LDAP content flows through AD/Entra anyway.

Let me know if you want to deep-dive into the configuration steps for any of these paths — happy to help!

answered a month ago
  • Kavz
    a month ago

    Thanks for the inputs TheQuietBuilder,

    Integrating the LDAP with Identity Center and extending the LDAP by deploying on EC2 are the 2 options I was considering and researching about.

0

Hey Kavz — thanks for circling back, and I’m really glad the info was helpful!

Between the two options you’re looking into (extending LDAP on EC2 or integrating with Identity Center), both can work depending on how much control and resilience you’re looking for. If you do decide to spin up the LDAP replica on EC2, I’m happy to help you think through the setup details — or if you want to explore the Identity Center angle more, we can talk through how that might connect depending on what your LDAP supports.

Feel free to drop more details here if you’d like to explore next steps. Happy to help however I can!

answered a month ago
0

Hey Kavz — thanks again for the update!

Since you're considering both paths — extending LDAP and integrating with Identity Center — here's a quick comparison and next-step suggestions, based on how much control and resilience you need:

Option A: LDAP Replica on EC2 Pros:

Keeps full on‑prem LDAP functionality

Can authenticate Linux sssd/PAM users directly using LDAP over TLS

Reduces latency and eliminates dependence on Direct Connect

Cons:

You’re responsible for EC2, backup, patching, and security

Still requires careful IAM and network setup via SSM

Resources:

Configure sssd.conf with LDAP ID mapping and TLS for secure authentication docs.aws.amazon.com +1 learn.microsoft.com +1 docs.aws.amazon.com +4 learn.microsoft.com +4 learn.microsoft.com +4 docs.cloudera.com +4 docs.redhat.com +4 aws.nz +4

Option B: AWS Managed Microsoft AD with Trust Pros:

Fully managed by AWS (no EC2 for AD infra)

Supports two-way trust with on‑prem AD — enabling seamless authentication learn.microsoft.com docs.aws.amazon.com +8 docs.aws.amazon.com +8 repost.aws +8

Integrates natively with AWS Identity Center and EC2 domain-join

Supports both Windows and Linux clients

Cons:

Requires AD compatibility and trust configuration

May involve schema considerations depending on OIM setup

Next-Step Suggestions: Decide your priority:

Want full LDAP control? Go EC2 + sssd/PAM

Prefer manageability and integration? Use Managed AD + AD trust

answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content