Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I asked this question over at stakoverflow without an answer yet, so I am trying my luck here as it may be more relevant to sysadmins..

We are trying to develop an ACL solution that would cater for both internal users (currently managed through Windows AD which is outside of the scope of the project) and external users. The idea is to have a new LDAP server, another Windows AD or non-AD server such as openldap, that will be used to manage external users and all groups that are to be used for the ACL.

And then a referral to the internal Windows AD would be setup so that authentication would work for both internal and external accounts and group membership to the groups defined in the new LDAP server would be open to both internal and external accounts.

The problem is to get the referral working, first following this document (under "Creating an External Cross-Reference for an Internal Location") it seems you need to have the external ldap server having the same domain as the internal one, this seems to be a problem, at least when using Windows AD as the external server as well.

Also due to security restrictions in place trust relationships cannot be created such that internal users can be added as members of groups created in the external server. So is there a way around this? Is it better to use openldap rather than Windows AD for the external server?

Any pointers would be much appreciated.


share|improve this question

What you are trying to do sounds a lot like a trust.

Where will those ACLs be? In some cases a one way trust can be appropriate..

Alternatively, check out ADFS (active directory federation services) which can be used to federate access without actual trusts, which is useful for external partners etc..

share|improve this answer
The ACLs will be on the external server, so I am assuming a one way trust, where the external server is trusting the internal AD should be fine? I'll look into ADFS as well, thanks – Haddad Feb 9 '11 at 9:27
A second forest with a trust is probably the appropriate solution here, but, the crossRef approach described by the OP is seperate and supported. – Brian Desmond Feb 21 '11 at 1:54

I'm not sure why you'd want to use OpenLDAP instead of a second AD forest with a one way trust, but, to your question, I've never actually seen a crossRef to a foreign directory implemented. That said I don't see any reason it needs to be within a contigous namespace.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.