3

We are looking to primarily use LDAP as a means of authentication throughout our environment consisting of both Linux and Windows boxes. I would like to know if there is a way to use our existing LDAP server to authenticate users on the Windows machines using AD? This would obviously greatly help from an engineering/administrative standpoint to just have one centralized location for user admin. As of now, we setup a user in LDAP, but that does not touch our Windows machines so we then have to create Domain users in AD. Just would like to simplify the process and allow for work on more important things. Thanks guys!

*I have stumbled upon adLDAP, http://adldap.sourceforge.net/, which seems to be a great starting point.

1
  • nss-ldap and pam-ldap support connecting directly to AD LDAP, never used them like this though Oct 22, 2010 at 16:40

3 Answers 3

3

You can't use any ol' LDAP server as a source for authentication for Windows machines. Active Directory is more than just an LDAP server.

Assuming you don't mind not having Group Policy I'd consider creating a Samba domain with LDAP-backed authentication to join your Windows machines to. This is about as close as you can get to an Active Directory environment with current Unix-based tools. Samba will eventually be able to emulate an Active Directory domain but it's not there yet.

1
  • Thanks for the quick response! Would adLDAP (Ldap over SSL) not be an option? The project looks very promising, but I am still confused by the complete functionality of it all. I guess I may need to experiment in a test environment.
    – Chase
    Oct 22, 2010 at 17:07
1

If you're looking to use your existing LDAP as your primary (sole) directory and ditch AD, then Evan Anderson's response is spot on.

If you're willing to ditch your existing LDAP and base everything out of Active Directory, then that should be possible. Anything that currently authenticates against your non-AD ldap should be able to authenticate against AD, thanks to ldap interface that AD exposes. Of course, if you're using LDAP for other things (not just authentication) then you may run into issues unless you can get AD to support those functions as well (by applying the necessary schemas, etc.)

As for adLDAP, I've never used it, but a quick look at the link you provided looks like it's simply a client library for talking to AD. From the standpoint of consolidating to one directory, I don't think it helps you.

However, it could potentially make keeping separate directories easier. For example, if you could modify your LDAP user-management software to make back-end calls to the AD (via adLDAP), then you could make it so that adding a user to LDAP automatically adds a user to AD, etc.

1
  • Thanks Bill, your bottom suggestion or idea is the route I am looking into right now. We are primary a linux shop so LDAP is a must for server access control.
    – Chase
    Oct 22, 2010 at 20:32
0

I believe you can use Samba, kerberos and LDAP to authenticate windows machines via AD. I'm not sure how wise this is.

You can use ldap tools (e.g. ldapadd, ldapmodify, ldap delete) or libraries e.g. PHP or perl LDAP modules to populate and maintain entries in AD.

So there is no reason you can't write script for user management that doesn't update both your LDAP and AD directories at the same time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .