Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It would be so great if I could just avoid all the API junk, and install a program on one of my servers that would actively monitor AD and G-Apps and sync stuff between them. I could just create special admin accounts in both AD and GApps for this program to use.

Optionally, it could offer a web portal for people to reset/recover there passwords.

Does anyone know of a program like this? I would prefer a Windows program with a nice installer.

share|improve this question
1… – Corey Apr 7 '11 at 16:11
up vote 1 down vote accepted

Is this too much to ask for?

Yes, in many ways it is. Passwords in both Google an AD are stored using a one way hash. The hashes between the two are not compatible. If you do not want to accept the risk of storing a reversible password in the AD then your only choice is to use the SSO solution. Unfortunately the SSO solution only works for the web. The SSO option does not work for imap/smtp/xmpp authentication.

None of the tools that speak SAML are simple to setup. As you said, usually it takes setting up a somewhat complicated web stack.

See my answer here for a description of what our organization did.

share|improve this answer
I’m aware of the limitation regarding passwords stored in AD, however passwords are the only thing that can’t be pulled from AD. A potential work around for that is to have users use a web form when ever they want to change there password. This web form could be provided by the same program or IIS. I’ve also heard talk of the ability to capture the passwords before AD hashes them, not really sure how that would work. – Corey Oct 2 '09 at 17:05

Here is a password filter that solves the synch problem. You could then use the google directory sync tool

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.