10

We have a services in a isolated network. These services need to authenticate users against the Active Directory server.

However the Active Directory server is not directly available so I have to setup a LDAP proxy in the isolated network. The LDAP proxy will then have access to the AD. Note that access must be read only and this proxy will have access to only one AD server.

  • Is this possible/feasible?
  • Is the term "proxy" the good term?
  • Is A Microsoft AD server mandatory or OpenLDAP will do the job fine?
  • I have few knowledge about AD/LDAP, how is the learning curve?
  • A few hints where to begin?

Thanks.

2 Answers 2

7

Is this possible/feasible?

This is both feasible and common. If you search for something like openldap proxy active directory you'll find a number of useful results.

Is the term "proxy" the good term?

This is absolutely the correct term to use.

Is A Microsoft AD server mandatory or OpenLDAP will do the job fine?

If your clients are only expecting an LDAP server then OpenLDAP will be just fine, particularly if you'll only need read-only access.

I have few knowledge about AD/LDAP, how is the learning curve?

Without knowing your background that's a hard question to answer. I find that LDAP is fundamentally simple, but wrapping your head around access control in OpenLDAP can take a little work.

A few hints where to begin?

If all you need to do is making the AD server available within your local network, then a simple TCP proxy or appropriate iptables rules will be much simpler than a full-blown LDAP proxy. The downside of this is that you would need to perform any access control on the Active Directory side of things.

If you decide to go with OpenLDAP as a proxy:

1

Active Directory Lightweight Directory Services seems like exactly what you need - but if you want to directly authenticate against AD, you could instead just do a TCP proxy back to your AD servers; HAProxy would be a good fit.

2
  • Do some iptables rules do the same job as you're describing? debian-administration.org/articles/595
    – SamK
    May 15, 2012 at 9:04
  • Actually, two more rules: 1. access must be read only 2. I have access to only one AD server.
    – SamK
    Jan 17, 2014 at 1:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .