Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have 2 problems that I'm hoping to find a common solution to.

First, I need to find a way to have multiple LDAP servers (Windows AD's across multiple domains) feed into a single source for authentication. This is also needed to get applications that can't natively talk to more than one LDAP server to work. I've read this can be done with Open LDAP. Are there other solutions?

Second, I need to be able to add those users to groups without being able to make any changes to the LDAP servers I'm proxying.

Lastly, this all needs to work on Windows Server 2003/2008.

I work for a very large organization, and to create multiple groups and have large numbers of users added to, moved between, and removed from them is no small task. This normally requires tons of paperwork and a lot of time. Time is the one thing we don't normally have; dodging the paperwork is just a plus.

I have very limited experience in all this, so I'm not even sure what I'm asking will make sense. Atlassian Crowd comes close to what we need, but falls short of having it's own LDAP front end. Can anyone provide any advice or product names?

Thanks for any help you can provide.

share|improve this question

3 Answers 3

I recommend OpenLDAP's meta backend, which acts as a proxy to integrate several naming contexts from several different servers in one single tree. I have successfully used it to do just this on several Windows 2003 domains.

For example, if you have several AD domains named ONE.COMPANY.COM and TWO.COMPANY.COM, you would end up with the following LDAP tree:

  • dc=company,dc=com
    • dc=one,dc=company,dc=com
      • Users and Groups from domain ONE
    • dc=two,dc=company,dc=com
      • Users and Groups from domain TWO

Thus, you could base authentication requests on the base DN dc=company,dc=com, which would return entries from either server.

Of course, you must make sure that you have an attribute that can uniquely identify users over all domains, such as an email address (you don't want to use a login name if you have two jdoe users! Unless you're sure logins are unique over all domains).

Check out OpenLDAP's back-meta man page.

Second, I need to be able to add those users to groups without being able to make any changes to the LDAP servers I'm proxying.

You can easily add a local database to the same instance of OpenLDAP, to contain groups that reference users from all proxied domains. They will have unique DNs on this server, just add them to groups and you're done.

share|improve this answer

This is an awesome article outlining how to set it up step-by-step: http://ltb-project.org/wiki/documentation/general/sasl_delegation (see "Pass-Trough authentication on several LDAP directories - with OpenLDAP ldap backend")

share|improve this answer

Is your organization using Active Directory? You can easily interface with AD using LDAP and since AD is a replicated, distributed system it by nature is single source. Or maybe I'm missing something of your requirements and/or your environment?

share|improve this answer
    
Sorry, I forgot to add the the servers are across multiple domains. There's already trust setup between them, but I'm not expert in this. I'm just the unfortunate sap that got stuck with this. I'll update my question to reflect the domains. –  Chris Jan 27 '10 at 17:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.