Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two Microsoft active directories, lets call them External and Internal,

What I want to do is:

  • Add users to Internal AD without password (Just save some other attributes for them).
  • When a user tries to login, the password will be checked against the External AD.
  • This is only for domain users not for the administrators.
  • Both Active Directories are on Windows servers.
  • I don't know what is the specific version of the External server. But I know it's a windows server.
  • I am able to authenticate users using openldap on linux. "By suppling a username and password". Which means it's possible to authenticate the users.

Please note that I am not trying to steal the passwords or anything. I just want my internal AD to send the username and password to the External AD and the External will respond if they match or not.

There are multiple services in my company that uses the External password for the employees ( like Exchange mail ). I want to keep them using the same username and password everywhere.

Here is the permissions I have:

  • I don't have any "Administrator" permissions on the External AD. Just a regular user permission.
  • I have full permission on the Internal AD.
  • I have full control over the computers and users that will try to login in the Internal AD.

some people suggested that I use cross-realm Kerberos trust along with guiding me to the right place of writing this question. I looked up the cross-realm Kerberos trust, But I found out that I need to have a password for the trust entered on both ADs. Which I can't do since I don't have Administrator permissions on the External AD.

You help is much appreciated. Thanks in advance

share|improve this question
Could you please clarify the "without the External administrator even knowing about it"-part of your question? – ErikE Dec 31 '13 at 9:05
I mean, he wouldn't know that internal users that authenticate from his active directory are actually being redirected from mine. – Abdulrahman Dec 31 '13 at 9:27
Ok, but when those users have trouble logging in or connecting to network resources, who is responsible for troubleshooting? From the perspective of the other admin I would certainly not be too happy resolving support requests and discovering an unauthorized auth proxy setup along the way. Doesn't it just seem like a perfect recipy for trouble? – ErikE Dec 31 '13 at 9:35
To my eyes the question, though interesting, does seem to fall under "unauthorized hacking" or "circumvention of security or policy" in – ErikE Dec 31 '13 at 9:40
Ok, but then why not simply talk to the admin(s) of the external AD? That role has the key to solve this quickly and painlessly. – ErikE Dec 31 '13 at 10:29
up vote 1 down vote accepted

Active Directory Lightweight Directory Services (AD LDS) sounds like a reasonable fit for what you're looking for. What you're calling the "Internal AD" can be an AD LDS instance that authenticates to what you're calling the "External AD".

I'm not sure I'm understanding your use case exactly, but I think AD LDS bind redirection would probably do exactly what you're looking for.

share|improve this answer
I never used AD LDS but I am trying to figure it out. Please give me some time for deploying and testing. Thank you for the answer Evan. – Abdulrahman Jan 1 '14 at 13:40
Can't we do the same with two AD DSs ? one AD DS that authenticates to the other AD DS without making a trust relation? – Abdulrahman Jan 1 '14 at 17:53
There is no functionality in the AD DS product to do that. AD LDS is the only AD functionality that supports authentication outside AD (aside from trust relationships). – Evan Anderson Jan 1 '14 at 20:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.