Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Given an existing LDAP server used for authentication, can Windows desktops authenticate users against LDAP or perhaps Kerberos?

share|improve this question
add comment

3 Answers

up vote 8 down vote accepted

I once tested this succesfully with pGina, but it's not very friendly to setup.

You can also use a SAMBA server acting as an Active Directory provider, with an LDAP backend, but I haven't tested this yet. Here are the two basic steps do:

SAMBA as a PDC

The basic configuration goes like this:

[global]
passdb backend = tdbsam
os level = 33
preferred master = auto
domain master = yes
local master = yes
security = user
domain logons = yes
logon path = \\%N\profiles\%U
logon drive = H:
logon home = \\homeserver\%U\winprofile
logon script = logon.cmd

[netlogon]
path = /var/lib/samba/netlogon
read only = yes

[profiles]
path = /var/lib/samba/profiles
read only = no
create mask = 0600
directory mask = 0700

More info on the SAMBA docs.

LDAP

Properly configuring an LDAP server is not something trivial (neither the SAMBA server IMHO), but after you configure one (OpenLDAP, FDS, etc.), here's some good info on how to integrate it with SAMBA. And more specific for RedHat.

I also hear SAMBA 4 will be a complete replacement for Active Directory, but who knows when that will be released.

Anyway, I don't know if this has become easier than when I tried it (about 2 years ago), but I hope so, because I gave up after a few weeks of trial... Maybe it's time to give it another go.

Back then, my personal preference was for FDS because it has a great admin console, and it was easier to set up.

Edit: I just remembered eBox. I haven't tested it because I don't like all-in-one solutions, but take a look at the site if you do (it offers plenty more than a domain controller).

share|improve this answer
add comment

Yes:

http://technet.microsoft.com/en-us/library/cc750824.aspx

share|improve this answer
    
This seems to go the wrong way. I'm not interested in Windows as a "provider" of LDAP, but as a "consumer." –  jldugger May 1 '09 at 20:55
    
I am also looking for something similar, where AD is a consumer! –  Mister IT Guru Jun 28 '11 at 11:46
add comment

Not without a custom logon provider (msgina replacement)...

Best bet is to either set up a Windows domain controller for Windows clients to log on to (will enable you to utilize group policies and other useful stuff) and have it sync with your existing LDAP service (check out Services for Unix). Or use samba and have it use your LDAP directory for authentication.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.