I have two Microsoft active directories, lets call them External and Internal,
What I want to do is:
- Add users to Internal AD without password (Just save some other attributes for them).
- When a user tries to login, the password will be checked against the External AD.
- This is only for domain users not for the administrators.
- Both Active Directories are on Windows servers.
- I don't know what is the specific version of the External server. But I know it's a windows server.
- I am able to authenticate users using openldap on linux. "By suppling a username and password". Which means it's possible to authenticate the users.
Please note that I am not trying to steal the passwords or anything. I just want my internal AD to send the username and password to the External AD and the External will respond if they match or not.
There are multiple services in my company that uses the External password for the employees ( like Exchange mail ). I want to keep them using the same username and password everywhere.
Here is the permissions I have:
- I don't have any "Administrator" permissions on the External AD. Just a regular user permission.
- I have full permission on the Internal AD.
- I have full control over the computers and users that will try to login in the Internal AD.
some people suggested that I use cross-realm Kerberos trust along with guiding me to the right place of writing this question. I looked up the cross-realm Kerberos trust, But I found out that I need to have a password for the trust entered on both ADs. Which I can't do since I don't have Administrator permissions on the External AD.
You help is much appreciated. Thanks in advance