asked on

Sync of AD DS to AD LDS

Hi experts,

here`s my situation:

- We have ActiveDirectory domain called test.local
- We have an Internet Application called www.test.net
- We want this application to use our internal AD User-Accounts in a specified OU or Authentication and SingleSign On.

What I would do:

- Setup a Windows Server 2012 with AD LDS on the Internet
- Connect the web application to use that LDAP

Now my question:
Can I use ADAMSync from my internal DC to synchronize user data to the LDS Server on the internet?
Would it be possible that the AD LDS server recognizes password-changes?
I read sth. about UserProxy objects in AD LDS.

Do my suggestions nake sense, or isn`t it possible to sync an internal DC with an external AD LDS?

How do you implement SSO features?

Thanks in advance!
Roland

Will Szymkowski

Based on what you are trying to accomplish you will need to use ADFS (Federated Services). See the below link for addtional details.
https://msdn.microsoft.com/en-us/library/bb897402.aspx

Will.

Systemadministration

ASKER

And why not AD LDS?
I read that AD FS needs the web application to be AD FS SSO ready.

My Web application has needs a LDAP-Directory to authenticate to.

Cliff Galiher

Because ADLDS, has not built-in functionality to sync credentials. You cannot get SSO which is what you stated you want. If you want auth and SSO, you want ADFS, not ADLDS.

Systemadministration

ASKER

And what if my Web App is not able to use AD FS for SSO?
Is it not possible to synch some users from my internal DC with ADAMSync to an external AD LDS? I would then user Proxy objects to have the passwords in synch.

Any other suggestion how to get SSO working for webapps that support LDAP as authentication provider?

ASKER CERTIFIED SOLUTION

Cliff Galiher

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Systemadministration

ASKER

Hi,

what about if I create a new AD-Domain on an Internet site.
Is there a way to synchronize internal AD User from OU "xx" to the external ActiveDirectory?

What I need is an external LDAP directory that is periodically synced with an OU of my internal Active Directory.

Any suggestions?

Cliff Galiher

There is not a way to to do what you propose, whether it is ADDS or ADLDS that will sync credentials. Passwords are protected differently that the rest of the object metadata in AD If you want true SSO or even "same password" type functionality, ADFS is your only reasonable choice.

Systemadministration

ASKER

But do I understand right:
I can not use any Web Application with AD FS?
AD FS is not an LDAP, correct?

I`m talking about an PHP-application called ILIAS elearning, that supports "LDAP", "CAS"and so on.

Cliff Galiher

There are plenty of web applications that work with ADFS. ADFS uses standards such as SAML, so it is up to the app developer to use those standards. If they do, it can use ADFS.

ADFS is not LDAP.

If the app does not support any of the protocols that ADFS supports and you are (understandably) unwilling to allow the app to authenticate against your internal domain controllers then you cannot have SSO at all. And if you want any sort of password syncing (which is not SSO), you'd need to invest in additional solutions such as forefront identity manager, configure PCNS, and define the custom data source. FIM is not free, nor is implementing PCSN in FIM a trivial task. If you aren't willing to spend TBe money purchasing FIM and learning how to implement a custom solution, you'll have to forego synced passwords as well.

You can use ADLDS as an LDAP back end for you app. But you can't have SSO or same passwords. Those are the requirements you seem to be getting stuck on.