Ldap – How to proxy multiple LDAP servers, and still have grouping of users on the proxy

groupsldapPROXY

I have 2 problems that I'm hoping to find a common solution to.

First, I need to find a way to have multiple LDAP servers (Windows AD's across multiple domains) feed into a single source for authentication. This is also needed to get applications that can't natively talk to more than one LDAP server to work. I've read this can be done with Open LDAP. Are there other solutions?

Second, I need to be able to add those users to groups without being able to make any changes to the LDAP servers I'm proxying.

Lastly, this all needs to work on Windows Server 2003/2008.

I work for a very large organization, and to create multiple groups and have large numbers of users added to, moved between, and removed from them is no small task. This normally requires tons of paperwork and a lot of time. Time is the one thing we don't normally have; dodging the paperwork is just a plus.

I have very limited experience in all this, so I'm not even sure what I'm asking will make sense. Atlassian Crowd comes close to what we need, but falls short of having it's own LDAP front end. Can anyone provide any advice or product names?

Thanks for any help you can provide.

Best Answer

I recommend OpenLDAP's meta backend, which acts as a proxy to integrate several naming contexts from several different servers in one single tree. I have successfully used it to do just this on several Windows 2003 domains.

For example, if you have several AD domains named ONE.COMPANY.COM and TWO.COMPANY.COM, you would end up with the following LDAP tree:

  • dc=company,dc=com
    • dc=one,dc=company,dc=com
      • Users and Groups from domain ONE
    • dc=two,dc=company,dc=com
      • Users and Groups from domain TWO

Thus, you could base authentication requests on the base DN dc=company,dc=com, which would return entries from either server.

Of course, you must make sure that you have an attribute that can uniquely identify users over all domains, such as an email address (you don't want to use a login name if you have two jdoe users! Unless you're sure logins are unique over all domains).

Check out OpenLDAP's back-meta man page.

Second, I need to be able to add those users to groups without being able to make any changes to the LDAP servers I'm proxying.

You can easily add a local database to the same instance of OpenLDAP, to contain groups that reference users from all proxied domains. They will have unique DNs on this server, just add them to groups and you're done.

Related Topic