Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We run an AD with 2003R2. I am in the process of doing Google Directory Sync, after that the plans are to go with SSO for Google Apps, and than I plan to have all our 3 world sites connected.

It just so happened, that today, our firewall (Fortigate) stopped working (it happened on midnight).

This brought me to think, that I can not count on the fact that the SSO will work, and if my AD/Network/Firewall is down, than no one can login to read their emails.

  1. Is that true?
  2. In that case, can I take my AD authentication/credential out of my company to a third party?
  3. If yes, what are the impacts? Pro's? Con's?
  4. How will that effect my main Intranet ? (main office has 60 employees + servers)


share|improve this question
up vote 1 down vote accepted

To answer your questions:

  1. Depends on what goes down and what it takes with it
  2. To a degree you can, this is called federated authentication, but it uses different protocols. E.g. SAML, WS-Fed, OpenAuth/ID. Only certain applications can support this (usually just web). Windows doesn't natively support such a design. You'd have to select an Identity Provider such as Google or Live ID or...
  3. See above. This also means that you may run into compliance issues etc. Most things would need to be configured, and that can get pretty hairy.
  4. It depends on how your intranet works. If it's all cloud-hosted apps that support federation, then this would work great. If its internally hosted apps that don't support the necessary protocols, you'd be SOL.

Personally, I'm a fan of this idea (it's also my area of expertise), but it can be a painful process due to legacy software, compliance issues, and lack of documentation (huuuuuuge problem).

share|improve this answer
Thanks, as part of this process, I will first upgrade my DC to W2K8. Than I will use it's abilities and google sync to sync my users. I will also try to have SF use that. – Saariko Aug 10 '11 at 12:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.