Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are looking to primarily use LDAP as a means of authentication throughout our environment consisting of both Linux and Windows boxes. I would like to know if there is a way to use our existing LDAP server to authenticate users on the Windows machines using AD? This would obviously greatly help from an engineering/administrative standpoint to just have one centralized location for user admin. As of now, we setup a user in LDAP, but that does not touch our Windows machines so we then have to create Domain users in AD. Just would like to simplify the process and allow for work on more important things. Thanks guys!

*I have stumbled upon adLDAP,, which seems to be a great starting point.

share|improve this question
nss-ldap and pam-ldap support connecting directly to AD LDAP, never used them like this though – Hubert Kario Oct 22 '10 at 16:40
up vote 3 down vote accepted

You can't use any ol' LDAP server as a source for authentication for Windows machines. Active Directory is more than just an LDAP server.

Assuming you don't mind not having Group Policy I'd consider creating a Samba domain with LDAP-backed authentication to join your Windows machines to. This is about as close as you can get to an Active Directory environment with current Unix-based tools. Samba will eventually be able to emulate an Active Directory domain but it's not there yet.

share|improve this answer
Thanks for the quick response! Would adLDAP (Ldap over SSL) not be an option? The project looks very promising, but I am still confused by the complete functionality of it all. I guess I may need to experiment in a test environment. – Chase Oct 22 '10 at 17:07

If you're looking to use your existing LDAP as your primary (sole) directory and ditch AD, then Evan Anderson's response is spot on.

If you're willing to ditch your existing LDAP and base everything out of Active Directory, then that should be possible. Anything that currently authenticates against your non-AD ldap should be able to authenticate against AD, thanks to ldap interface that AD exposes. Of course, if you're using LDAP for other things (not just authentication) then you may run into issues unless you can get AD to support those functions as well (by applying the necessary schemas, etc.)

As for adLDAP, I've never used it, but a quick look at the link you provided looks like it's simply a client library for talking to AD. From the standpoint of consolidating to one directory, I don't think it helps you.

However, it could potentially make keeping separate directories easier. For example, if you could modify your LDAP user-management software to make back-end calls to the AD (via adLDAP), then you could make it so that adding a user to LDAP automatically adds a user to AD, etc.

share|improve this answer
Thanks Bill, your bottom suggestion or idea is the route I am looking into right now. We are primary a linux shop so LDAP is a must for server access control. – Chase Oct 22 '10 at 20:32

I believe you can use Samba, kerberos and LDAP to authenticate windows machines via AD. I'm not sure how wise this is.

You can use ldap tools (e.g. ldapadd, ldapmodify, ldap delete) or libraries e.g. PHP or perl LDAP modules to populate and maintain entries in AD.

So there is no reason you can't write script for user management that doesn't update both your LDAP and AD directories at the same time.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.