I have the following situation: I have a web site that needs to authenticate users, some of these will be internal users that are stored in an active directory domain, but there will be other users (ie customers and contractors) that I do not want to store in AD, but still would like to have them maintained in a central LDAP database.
So, I thought it would be nice to authenticate the webserver against the local LDAP, and if a user was not found, have it transparently pass the query on to the AD LDAP server.
Is this possible? I've looked through LDAP documentation and I'm still not too sure about all the options available.
I'd be using OpenLDAP on linux.