Hi.
I'm new to the world of LDAP and directory servers and trying to figure out the best solution to my problem.
This isn't exactly OpenLDAP specific, I still haven't figured out whether OpenLDAP is the right thing to use or whether there is any good solution to my situation.
So I hope you forgive me for asking this here but I'm hoping to tap into the collective knowledge of this list for ideas.
My situation is that I have taken over the systems administration of a group of Linux servers for the Computer Science department at my school. The school has an IT department but we would like to be independent of them, both to relieve them of as much as possible of our demands (which can be quite demanding and unorhadox) as well as having a more agile environment here (again touching on the fact that they are overloaded).
The IT department mostly runs Microsoft solutions and the whole domain is controlled by Active Directory. I'm not familiar with AD myself so I don't know whether it's a particularly "good setup" or not but I have no reason to believe otherwise.
So, what I want to do is set up our own directory server but of course I would like to use some open source solutions... or at the very least, something that runs on Linux. There I would like to control authorization for different users to different servers, clusters, web systems (such as wiki webs, Subversion, bug tracking software etc). On the other hand, I would prefer that authentication be somehow delegated to the AD server for any user who is on the domain to avoid duplicating data. However, I still would like to be able to define additional users in my LDAP directory server that are not necessarily on the domain. So my setup would have to be able to distinguish whether authentication should be handled by my LDAP server or the AD server. I would think this could happen in two ways: 1) user credentials are replicated over to the LDAP server from AD which means that LDAP would handle all authentication or 2) LDAP server would delegate authentication for users it cannot authenticate to the AD server but otherwise it would handle the users it knows. I assume 1 is difficult to do as sending the user credentials out from AD is probably considered bad practice (if it is at all possible that is).
The backup plan would be for me to get administrative rights to some part of the AD server and then we'd use only that server for all authentication and authorization requirements but as I said, we would like to be as independent from their services as possible in addition to not being particularly fond of having to use AD (is there any sort of a usable web access to that? would this mean I would have to have a Windows box set up to perform any administrative tasks?).
This is my situation. Sorry for the log winded explanation. Does anybody have an idea of how to accomplish something like this? I'd be happy to hear about any case studies or white papers on similar subjects (I can't believe I'm the first one to want to do this). I'm also open for suggestions on what tools to use. Open source is not a requirement (but preferred).
Best regards, Stefan Freyr.
"Stefan Stefansson" stefan@ru.is writes:
Hi.
I'm new to the world of LDAP and directory servers and trying to figure out the best solution to my problem.
This isn't exactly OpenLDAP specific, I still haven't figured out whether OpenLDAP is the right thing to use or whether there is any good solution to my situation.
So I hope you forgive me for asking this here but I'm hoping to tap into the collective knowledge of this list for ideas.
My situation is that I have taken over the systems administration of a group of Linux servers for the Computer Science department at my school. The school has an IT department but we would like to be independent of them, both to relieve them of as much as possible of our demands (which can be quite demanding and unorhadox) as well as having a more agile environment here (again touching on the fact that they are overloaded).
The IT department mostly runs Microsoft solutions and the whole domain is controlled by Active Directory. I'm not familiar with AD myself so I don't know whether it's a particularly "good setup" or not but I have no reason to believe otherwise.
So, what I want to do is set up our own directory server but of course I would like to use some open source solutions... or at the very least, something that runs on Linux. There I would like to control authorization for different users to different servers, clusters, web systems (such as wiki webs, Subversion, bug tracking software etc). On the other hand, I would prefer that authentication be somehow delegated to the AD server for any user who is on the domain to avoid duplicating data. However, I still would like to be able to define additional users in my LDAP directory server that are not necessarily on the domain. So my setup would have to be able to distinguish whether authentication should be handled by my LDAP server or the AD server. I would think this could happen in two ways: 1) user credentials are replicated over to the LDAP server from AD which means that LDAP would handle all authentication or 2) LDAP server would delegate authentication for users it cannot authenticate to the AD server but otherwise it would handle the users it knows. I assume 1 is difficult to do as sending the user credentials out from AD is probably considered bad practice (if it is at all possible that is).
The backup plan would be for me to get administrative rights to some part of the AD server and then we'd use only that server for all authentication and authorization requirements but as I said, we would like to be as independent from their services as possible in addition to not being particularly fond of having to use AD (is there any sort of a usable web access to that? would this mean I would have to have a Windows box set up to perform any administrative tasks?).
This is my situation. Sorry for the log winded explanation. Does anybody have an idea of how to accomplish something like this? I'd be happy to hear about any case studies or white papers on similar subjects (I can't believe I'm the first one to want to do this). I'm also open for suggestions on what tools to use. Open source is not a requirement (but preferred).
In principle authentication via active directory can be achieved by means of some different backends, the most appropriate would probably be slapd-ldap(5) and some rewriting, but slapd-perl(5) or slapd-sock(5) could also be included, depending on your skills. I would suggest to read http://www.openldap.org/doc/admin24/ first and set up a test environment in order to get acquainted with directory setup.
-Dieter
On Mon, Dec 08, 2008 at 11:31:21AM +0000, Stefan Stefansson wrote:
- user
credentials are replicated over to the LDAP server from AD which means that LDAP would handle all authentication or
You will never get the existing passwords out of AD because they are not there.
If the people running the AD domain are prepared to co-operate you may be able to load a 'password checker module' into the AD domain controllers. This could tell you whenever a new password is set (and pass over the cleartext password). This allows you to keep up to date with new accounts and password changes.
- LDAP server would
delegate authentication for users it cannot authenticate to the AD server but otherwise it would handle the users it knows.
That may be easier - for one thing you do not need to do anything scary to the central AD servers. See 'Pass-Through Authentication' in the Admin Guide:
http://www.openldap.org/doc/admin24/security.html#Pass-Through%20authenticat...
In principle you could use either LDAP or Kerberos access to the AD domain to implement this, though I think LDAP would be easier.
It is also worth looking at the contributed slapd modules, as I think there is one that delegates authentication to a remote AD and then builds a local entry if the password is OK. smbk5pwd perhaps?
Whichever way you go, you will need some regular process to deal with account updates and deletions.
Andrew
On Monday 08 December 2008 15:15:44 Andrew Findlay wrote:
On Mon, Dec 08, 2008 at 11:31:21AM +0000, Stefan Stefansson wrote:
- LDAP server would
delegate authentication for users it cannot authenticate to the AD server but otherwise it would handle the users it knows.
That may be easier - for one thing you do not need to do anything scary to the central AD servers. See 'Pass-Through Authentication' in the Admin Guide:
http://www.openldap.org/doc/admin24/security.html#Pass-Through%20authentic ation
In principle you could use either LDAP or Kerberos access to the AD domain to implement this, though I think LDAP would be easier.
It is also worth looking at the contributed slapd modules, as I think there is one that delegates authentication to a remote AD and then builds a local entry if the password is OK. smbk5pwd perhaps?
No, adpwc, which is stuck in ITS (#5042).
Depending on the exact requirements, bi-directional Kerberos trusts could also be a solution here.
Regards, Buchan
openldap-technical@openldap.org
-
Andrew Findlay -
Buchan Milne -
Dieter Kluenter -
Stefan Stefansson