We have an organizational Windows domain xxx.org which provides DHCP, Gateway, Network, Winbind, firewall, etc. At a remote site we have another domain yyy.org that we manage and control. Currently, all users at remote site, as part of the parent domain, login and authenticate accordingly.

Strictly for the purpose of user creation and authentication utilizing the email construct i.e. name@yyy.org we setup a ubuntu 14.04 server with Samba 4.1 Active Directory. Samba AD allows us to create users with the email construct. We can then, hopefully, SSO to services that require email construct login.

The problem is getting the windows client to join the yyy.org domain. We set the DNS IP to point to samba AD and we change the computers domain to yyy.org. But the client still binds to the parent domain.

Previously, in the process of experimentation, we setup Ubuntu to serve up DHCP and the client binding to yyy.org was successful. It may be we have to do this again, I’m not sure. As we said in the first post we have limited knowledge. And, of course, we want this to be seam-less to the parent domain.

  • Question has been revised. I hope it is more clear. Thanks for your understanding. – Cole Ragland May 8 '15 at 5:06

yes, it should be possible to get the SSO for the Windows and Mac Clients using Samba 4 and as long as the Server is in the same Network you won't have to do changes to the firewall. If you have to have the servers in a different network, there is a good chance that you will have to open additional Ports.

Chromebooks are not as easy to integrate. Here you have a two step process. First you have to connect your Server to Google Apps using the Google Apps Sync tool https://support.google.com/a/answer/6123891 , this keeps the user data in sync, and then attach google apps to the server using SAML for the password authentication. Afterwards any google apps service will use the data you provisioned into the system.

As for the domain, use an unused subdomain of yyy.org like internal.yyy.org or something similar. That way your internal DNS won't block any external websites and you can be sure, that no one registers or re-purposes your domain, like it happened with .local .

If you have limited tech skills, I would suggest looking at free enterprise distributions that comes with a management interface and are tested for this purpose, such as Univention's UCS Core Edition. It normally makes the setup and administration easier.

  • Thank you Kevin. I have re-posted the question as it is more specific to our problem with binding. Also, if this does not resolve easily, can you recommend online consultant with according expertise? – Cole Ragland May 8 '15 at 5:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.