Im pretty new to LDAP and AD. I have to port our present authorization/authentication structure from AD to OpenLDAP. Is it possible to run the entire setup in windows? What are the steps for migration of the policies and adjustments req.? I'v read up a few tutorials, so should be able to follow the inputs. Regards, Anthony G.
My first answer would be don't...
What I think you are actually asking is: How do I port from Microsoft AD Domain to a Samba/OpenLDAP/Kerberos setup. It's Samba that actually handles the authentication/authorisation side of things - OpenLDAP is just a directory.
Samba barely does group policies - you need to use the NTPOL editor from Windows NT4 days - it only has 70-80% of the functionality of XP local group policy (before some wise guy pipes up about Samba 4 - it's not out yet, one day maybe). You can apply Samba policy only to user groups not computer groups- the list goes on.
There are no easy migration wizards, pretty much every Samba tutorial does it from scratch, which is what you may end up doing. And in the end you will end up with a setup that is not as good as before - I suggest you think long & hard about whether it is the right thing to do (and yes I do support a Samba domain, and wish every day I had a Windows one).
If you're using AD authentication, your actual auth is Kerberos, not LDAP. The user principals are stored in LDAP, yes, but the auth step is Kerberos. OpenLDAP alone won't give you feature parity (Single Sign On) with AD. You'll need to pair it with a Kerberos server, such as Heimdal or MIT Kerberos, for that.
This is not a simple or easy process. For an organization of any size, this is something that should be done by an MCSE with a solid handle on enterprise software architecture and some experience with UNIXish operating systems.