29

I see tons of solutions for allowing Google Apps to use external AD and LDAP services for login.

However, I already have a ton of users setup in Google Apps already, and I'm trying to go the other way around. That is, I'd like to allow users to log into my external servers using the accounts I created in Google Apps.

Has anyone successfully discovered a way to use a Google Apps domain as an Open Directory, Active Directory, or LDAP provider?

13

This is absolutely impossible.

Yes, there are means to synchronize between local directory services and Google's directory, but that doesn't mean that you can use Google's directory like AD, OD, or even a simple LDAP service.

Now, if all you want is to enable users to be able to use their Google credentials to sign into your application, look into OpenID.

  • 3
    Google certainly doesn't provide an LDAP interface, but someone could write a program to pull account details from the API, and add them to an LDAP data source. They only thing you can't get are the passwords. – Zoredache Feb 24 '12 at 19:10
  • @Zoredache - sure, that would be possible. Probably not a reality for the OP, though. (but maybe that's an inappropriate assumption) – EEAA Feb 24 '12 at 19:11
  • This is possible now, see comment below serverfault.com/a/928342/120370 – larsen161 Oct 26 '18 at 1:56
8

http://www.nabber.org/projects/oneldap/ provides a backend for OpenLDAP that can at least authenticate users against various services (IMAP, POP, SSH, etc.). It would be possible to write a plugin to use the Google Client Login API directly if you wanted.

This solution would at least work for an app that used LDAP for authentication, but is far from a complete LDAP/AD server.

  • 2
    This doesn't answer the how question, and I believe it is more a comment than an answer. – vgoff Nov 17 '12 at 4:02
  • 3
    It does answer the question. – Bhargav Nanekalva Sep 11 '13 at 10:56
  • The link is broken. – Erowlin Sep 24 '18 at 8:03
3

Google have just released Secure LDAP which does what you want. Note you'll need to have G Suite Enterprise, G Suite for Education or add Cloud Identity Premium to your domain

2

so basically, you want to have Google Apps act as your domain controller?

I don't think Google Apps has the ability to actually be the DS (directory service). Now, that being said, you can use ADFS 2.0 in your domain to allow those Google Apps users to sign into claims-based applications that you host.

This walkthrough (which goes over extending SharePoint with OpenID logins) addresses ADFS 2.0, SSO, Federation, and all the other principles you need to grasp to make this happen.

2

I have also been looking at a solution for this and the only thing I can find is this https://jumpcloud.com/

It provides the LDAP and uses the Google directory for user information.

  • Been looking too, and it seems the JumpCloud offers the whole kit and the best method for LDAP/AD integration. Actually, JumpCloud seems to offer a nice infrastructure management platform which looks tempting. I did find this Google Support page though support.google.com/a/answer/106368?hl=en that talks about Google Syncing with your LDAP/AD, making your LDAP/AD server a Secondary Domain Controller, so if you're okay with running your own LDAP/AD [secondary] controller, might get you what you want... – Guy Park May 22 '18 at 0:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.