I have an Active Directory Lightweight Directory Services set up. I have objects that represent users in the Active Directory (Domain_A). I have set their objectSID attribute, and users can authenticate to LDS with their Active Directory password. I love it.
Here is a formatted Wireshark network trace of a successful LDS proxy authentication :
LDAP bindRequest(1) "cn=ixe013,cn=Users,cn=Fizz,dc=Buzz,dc=tst" simple KRB5 AS-REQ KRB5 KRB Error: KRB5KDC_ERR_PREAUTH_REQUIRED KRB5 AS-REQ KRB5 AS-REP KRB5 TGS-REQ KRB5 TGS-REP LDAP bindResponse(1) success LDAP unbindRequest(2)
I want to bring in new users, from a different Active Directory (Domain_B) that has not trust relationship whatsoever with the Active Directory from Domain_A.
Is there a way to tell LDS in which domain to look for users or does it always look in the domain it is in, maybe by using another protocol than Kerberos ?
+I figured out user provisionning, no need to mention it. Thanks !