Problem: Creating and maintaining hundreds of student accounts
The school where I work runs Active Directory on Server 2008. Every year, our students have to sign up for accounts with a third-party SaaS school management system. That has created a lot of work in the past, as codes have to be generated for students, and students often lose the codes or can't figure out how to enter them. Later, the students who did manage to sign up may forget their usernames or passwords and come to me (the solo sysadmin) for password resets and so forth.
Solution 1: Ask users for their passwords
This fall, we moved to a new SMS, which apparently doesn't support any kind of batch student signup. The administration was planning to meet with every student, ask him or her for a username and password, and create an account for him or her manually. I thought, Wouldn't it be nice if we could integrate the two systems and avoid that? When I contacted the third-party company, though, they said they didn't integrate with Active Directory.
I decided to make my own system: a database coupled with a program that runs as a logon script for student accounts. It works like this:
- When students log into Windows for the first time, they are asked for their passwords
- The passwords are checked against the passwords stored in Active Directory
- If they match, the passwords are stored in the database (the passwords cannot simply be dumped from Active Directory into the database because Active Directory passwords are write-only)
- A server-side component of the program creates accounts for the students with the third-party company, using the Active Directory passwords stored in the program's database
Now, the problem with that is that if users' passwords are reset in Active Directory, they are not updated in the database. If users change their passwords from workstations, the passwords are not updated in the database. There is also the issue of the security of the database itself.
Solution 2: Reversible encryption
I notice that Active Directory can store passwords with reversible encryption. I know it is not officially well-documented, and am well aware that even writing the phrase "password retrieval" carries with it the possibility of bringing about The End of the World. But looking at the risk, I don't believe our servers are in much danger of being compromised, and even if they were, there is not much an attacker could do with the students' accounts.
How would you recommend I solve this problem? Is there a way I can drop my middleman database and simply use information from Active Directory directly? Should I abandon trying to integrate the systems?
Any thoughts are welcome, including remarks on how harebrained my idea for single sign-on was in the first place.