0

I am wondering if it is possible to cause AD to service authentication requests in any way besides simply consulting its internal password hashes. Ideally, I'd like to have it call code I provide which is passed the username/password and makes the authorized/not authorized decision for each authentication request the DC receives. I'd also settle for an arrangement whereby the authentication is still handled by AD's internal mechanisms, but accounts are only authorized to log in to Windows systems if my custom code clears them.

Most of our systems are Linux and authenticate against an OpenLDAP directory...this is an attempt to make a single attribute per account in OpenLDAP definitive for access to all systems in our organization, Windows or Linux.

Improve this question

1 Answer 1

Reset to default
1

You're going to have better success with a federation-based approach. To my knowledge there are no points of extension inside the portion of Windows that runs Active Directory to do what you're looking for. (There are points in the OS, acting as a client to AD, that you could extend the OS to do what you're looking for.)

Kerberos-based authentication, back-ending to your OpenLDAP, with a trust from your AD to your Kerberos Realm could be a reasonable solution. Alternatively you could look at dropping OpenLDAP and extending the AD schema to support everything you're using OpenLDAP for, as well.

Improve this answer
2
  • 1
    Seconded. Both sides are mature enough these days that you can go either way. Either have your Windows machines authenticating against an MIT Kerb realm with authorization still happening via AD. Or have your Linux machine authenticate and authorize against AD and its LDAP implementation.
    – Ryan Bolger
    Apr 3, 2014 at 17:29
  • Or more succinctly, there's very little reason these days to have user passwords exist in more than one place even in multi-platform environments.
    – Ryan Bolger
    Apr 3, 2014 at 17:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .