We currently have AD and OpenLDAP deployed at our organization.
I was wondering if anyone has worked in a similar setup and would like to share some of the steps taken to keep the sysadmins sane.
How do you perform account provisioning?
Do all accounts exist in both directories? If not, where does the logic for deciding which directories a new account will exist in reside? How are exceptions handled? And how about if changes to a user's entitlements warrant creation or deletion of an account on a directory?
How do you synchronize account attributes including password changes? Are one of the directories considered "master"? If so, which one and why?
What went into the decision of having a dual directory environment? Are there plans to move away from this setup? If so why? And what steps are being taken to assure a smooth (like that ever happens) transition?
What kind of management tools do you tend to use (for account deletions, troubleshooting, etc)? And where do the preside---on a DC, an OpenLDAP server or perhaps on a different Windows or Linux box.
Our organization has no choice but to implement both directories because of specialized applications that require either AD or OpenLDAP.