Avatar of Systemadministration
Systemadministration
 asked on

Sync of AD DS to AD LDS

Hi experts,

here`s my situation:

- We have ActiveDirectory domain called test.local
- We have an Internet Application called www.test.net
- We want this application to use our internal AD User-Accounts in a specified OU or Authentication and SingleSign On.

What I would do:

- Setup a Windows Server 2012 with AD LDS on the Internet
- Connect the web application to use that  LDAP

Now my question:
Can I use ADAMSync from my internal DC to synchronize user data to the LDS Server on the internet?
Would it be possible that the AD LDS server recognizes password-changes?
I read sth. about UserProxy objects in AD LDS.

Do my suggestions nake sense, or isn`t it possible to sync an internal DC with an external AD LDS?

How do you implement SSO features?

Thanks in advance!
Roland
Active Directory

Avatar of undefined
Last Comment
Cliff Galiher

8/22/2022 - Mon
Will Szymkowski

Based on what you are trying to accomplish you will need to use ADFS (Federated Services). See the below link for addtional details.
https://msdn.microsoft.com/en-us/library/bb897402.aspx


Will.
Systemadministration

ASKER
And why not AD LDS?
I read that AD FS needs the web application to be AD FS SSO ready.

My Web application has needs a LDAP-Directory to authenticate to.
Cliff Galiher

Because ADLDS, has not built-in functionality to sync credentials. You cannot get SSO which is what you stated you want. If you want auth and SSO, you want ADFS, not ADLDS.
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
Systemadministration

ASKER
And what if my Web App is not able to use AD FS for SSO?
Is it not possible to synch some users from my internal DC with ADAMSync to an external AD LDS? I would then user Proxy objects to have the passwords in synch.

Any other suggestion how to get SSO working for webapps that support LDAP as authentication provider?
ASKER CERTIFIED SOLUTION
Cliff Galiher

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
Systemadministration

ASKER
Hi,

what about if I create a new AD-Domain on an Internet site.
Is there a way to synchronize internal AD User from OU "xx" to the external ActiveDirectory?

What I need is an external LDAP directory that is periodically synced with an OU of my internal Active Directory.

Any suggestions?
Cliff Galiher

There is not a way to to do what you propose, whether it is ADDS or ADLDS that will sync credentials. Passwords are protected differently that the rest of the object metadata in AD  If you want true SSO or even "same password" type functionality, ADFS is your only reasonable choice.
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
Systemadministration

ASKER
But do I understand right:
I can not use any Web Application with AD FS?
AD FS is not an LDAP, correct?

I`m talking about an PHP-application called ILIAS elearning, that supports "LDAP", "CAS"and so on.
Cliff Galiher

There are plenty of web applications that work with ADFS. ADFS uses standards such as SAML, so it is up to the app developer to use those standards. If they do, it can use ADFS.

ADFS is not LDAP.

If the app does not support any of the protocols that ADFS supports and you are (understandably) unwilling to allow the app to authenticate against your internal domain controllers then you cannot have SSO at all. And if you want any sort of password syncing (which is not SSO), you'd need to invest in additional solutions such as forefront identity manager, configure PCNS, and define the custom data source. FIM is not free, nor is implementing PCSN in FIM a trivial task. If you aren't willing to spend TBe money purchasing FIM and learning how to implement a custom solution, you'll have to forego synced passwords as well.

You can use ADLDS as an LDAP back end for you app. But you can't have SSO or same passwords. Those are the requirements you seem to be getting stuck on.