I'm setting up a Debian server in my company where users are managed in an Active Directory.
I'd like to authenticate users with AD but I'm thinking it would be better, if feasible, to have a local OpenLDAP to authenticate against in case AD server or network falls.
I've seen tutorials about setting up pass-through authentication
but it doesn't say what happens if the AD server is not reachable. AFAIU, the request fails.
Someone here suggest using OpenLDAP Proxy Cache Engine setting a high TTL.
Should I be replicating the whole directory instead ? I don't mind if new users can"t be authenticated. I'd be happy if already locally known users can be authenticated using the last accepted password. So the easiest solution is my favorite.
I searched with a lot of terms including cache/caching, replica, etc. I didn't find any "grab-my-hand-and-show-me-how-to-do-that-on-debian-jessie" step-by-step solution, so it could be that what I thought would be relatively standard is in fact a bit tricky.