Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have the following situation: I have a web site that needs to authenticate users, some of these will be internal users that are stored in an active directory domain, but there will be other users (ie customers and contractors) that I do not want to store in AD, but still would like to have them maintained in a central LDAP database.

So, I thought it would be nice to authenticate the webserver against the local LDAP, and if a user was not found, have it transparently pass the query on to the AD LDAP server.

Is this possible? I've looked through LDAP documentation and I'm still not too sure about all the options available.

I'd be using OpenLDAP on linux.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

Yes, you can setup OpenLDAP to act as a caching proxy LDAP server, back-ended by AD.

See this for example (but just do a search for "can openldap proxy ldap requests to active directory" and you'll have plenty to look through".

share|improve this answer
add comment

You could store them in an ADAM partition (now called AD LDS in 2008 speak). Then you can have all your users (internal and external) in one directory service. You would not need to manage openldap and you can use the same tools used to manage your existing users to manage your extenal ones without putting the external user in your current forest. You can find an ADAM overview here:Create Custom Directories with ADAM

share|improve this answer
    
I was going to suggest this as well. You don't need a flat AD structure, you can mix it up and obtain the results you're looking for –  Matt Simmons Jun 1 '09 at 3:36
    
Well, not ADAM specifically, but creating an OU for contractors and the like, and authenticating them against their LDAP OU, but however you do it, I would stick with active directory –  Matt Simmons Jun 1 '09 at 3:38
    
nice answer, I'll check it out. But I don't admin the AD server, and its seen a a 'essential corporate service' so its not easily modified without many people's sign off :( As a result, I do not manage the corporate users at all, and corporate IT services do not have any remit over my customer logins. (I'm sure you've known the situation ;) –  gbjbaanb Jun 1 '09 at 10:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.