2

I need some guidance with AD and OpenLDAP user database integration/synchronization. Here is what I am trying to do.

We have Full Linux database (Ubuntu 10.4) with users on OpenLDAP and using only opensource applications (POSTFIX, Fileserver, Print server, Apache, VPN etc.). Currently all windows client machines (Mostly 7 and Vista) are not on a Domain. We want to introduce Active directory because of its excellent features when it comes to handling users, plus with it can also handle update patches and we can have a variety of restrictions on users using group policies.

I have been digging on the web for a couple of days but have had no luck in finding something that can synchronize user information from AD to openldap so we can have one user password for all applications. We would like to have a centralized user database with one password for all applications.

I hope I was able to explain it correct on what I am looking for. Please let me know if you have implemented something similar to synchronize user password information between AD and OpenLDAP. I will appreciate any input.

Improve this question

2 Answers 2

Reset to default
1

The way to go is to kerberize the linux logon. That way the password gets sent to AD, while all the other information will be fetched from LDAP. It works here, but I dont have the scripts at hand.

Improve this answer
0

The way I handled a similar situation was to install a password filter DLL on each Active Directory domain controller, which snagged all password changes and then inserted them into my synchronized system. I used passwdhk, and it worked fine; it will register itself for password change events and then pass the event to an external program or script you specify. The only big caveat I have is that you'll want to be careful about what script or program you run, since it will have access to plaintext passwords (for instance, you don't want a script that bails and prints a stack trace with the password in it if somebody uses a bad character).

We investigated several other solutions, including:

  1. Using reversible encryption to store the passwords
  2. Setting up a web page for people to change their passwords through, which would then take the cleartext password while it had it and add it to the new system
  3. Cracking the AD password hash file on a regular basis and then re-encrypting them into the new system

In the end, the password filter wound up being the most robust and secure solution, and it wasn't as hard to implement as I initially thought it would be.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .