My problem is that I have a number of network administration applications like SAN switches that do not support nested groups from Active Directory Domain Services (AD DS). These legacy administration applications use either LDAP or LDAPS.
I am fairly sure I can use Active Directory Lightweight Directory Services (AD LDS) and possibly Windows Authorization Manager to work around this issue; however I am not really sure where to start.
I want to end up with:
- A single group that can be queried over LDAP/LDAPS for all it’s direct members
- LDAP proxy for user name and password credentials to AD DS
- Easy way to admin the group, ideally the group would aggregate the nested membership in AD DS.
- a native solution using freely available components from the Windows stack.
If you have any suggestions or solutions that you have previously used to solve this issue please let me know.