Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We currently have AD and OpenLDAP deployed at our organization.

I was wondering if anyone has worked in a similar setup and would like to share some of the steps taken to keep the sysadmins sane.


  1. How do you perform account provisioning?

  2. Do all accounts exist in both directories? If not, where does the logic for deciding which directories a new account will exist in reside? How are exceptions handled? And how about if changes to a user's entitlements warrant creation or deletion of an account on a directory?

  3. How do you synchronize account attributes including password changes? Are one of the directories considered "master"? If so, which one and why?

  4. What went into the decision of having a dual directory environment? Are there plans to move away from this setup? If so why? And what steps are being taken to assure a smooth (like that ever happens) transition?

  5. What kind of management tools do you tend to use (for account deletions, troubleshooting, etc)? And where do the preside---on a DC, an OpenLDAP server or perhaps on a different Windows or Linux box.

Our organization has no choice but to implement both directories because of specialized applications that require either AD or OpenLDAP.

share|improve this question
up vote 0 down vote accepted
  1. How do you perform account provisioning? We have a custom internally-developed application that interfaces with both systems. The work entry/exit process are hyper-detailed and only part of that concerns the technology systems. There is a customized vendor-provided web application for servicing the actual requests.

  2. Do all accounts exist in both directories? Not necessarily. All users have an LDAP account, but they may not have an AD account.

  3. How do you synchronize account attributes including password changes? We have LDAP attributes for the AD groups and a few others, such as postal addresses, phone numbers, etc. These are synchronized with a custom application that is not that complicated. We synchronize passwords both ways. If a user changes their AD password, that is synchronized to the LDAP environment, and vice-versa. Suffice it to say that both environments should have the same password complexity requirements. Are one of the directories considered "master"? No.

  4. What went into the decision of having a dual directory environment? Politics. Are there plans to move away from this setup? No. We have a substantial linux server base, and all of their authentication is performed against the LDAP directory.

share|improve this answer
How do you push the password changes to the other directory? – Belmin Fernandez Oct 20 '10 at 3:12
We have a custom passfilt.dll that intercepts the password change and synchronizes that with the LDAP directory. We also have a web portal that provides a challenge and upon success changes the password in both environments. – Greg Askew Oct 20 '10 at 3:57

For years and years we had parallel Active Directory and Novell eDirectory environments. AD was required for Exchange, and eDirectory required for all the NetWare servers we had (and now don't). So I'm familiar with the problem here. There is one key detail that allowed us to operate both environments:

The authoritative identity store was a third system. SCT Banner in our case, but the same could be done with any other ERP system.

HR processes define the conditions needed to be 'eligible for accounts'. Once someone was on that list, once (or twice) a day a CSV file is generated with the agreed upon particulars. This CSV file is then picked up by our account provisioning processes which:

  • Generates the eDir account (now dead)
  • Generates the home-directory
  • Generates the AD account
  • If Faculty/Staff, generate Exchange mailbox
  • Generates the NIS+ account (dead as of last week)
  • If Student, generate outlook@live mailbox.
  • Sets address-book attributes in both directories as appropriate
  • Disables all three (four for students) accounts

We then have all new users go through an Account Activation process (a web-page) that enables their account, and does the initial password setting. Since this is a separate process, we capture their password as part of this process and submit it to both directories through normal password-change API.

We then do what we can to prevent the user from changing their own password through native tools, forcing them to use a Password Change web-page we wrote.

All users exist in both environments, and have the same password.

Deprovisioning is done the same way. HR process remove accounts from the eligible list. Their absence in the CSV exports is noted by the IDM processes and starts the deletion process. It disables the accounts for two weeks, and after two weeks deprovisions everything.

Managing all of this is a mixture of native tools for obscure operations and a web-management portal we wrote to handle things like lockout-resets, group membership operations, print-quota operations, and other such things.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.