Owing to a corporate strategy I am moving human user authentication from an implementation of LDAP locally to a centralized Active Directory domain. The problem is that we have a tightly constrained sudoers setup within LDAP. Our Windows admins are unable to mirror this setup without considerable work and possibly not even completely if the time is devoted. An idea that was posed was this:

Authenticate to Active Directory but maintain sudoers management within our existing LDAP infrastructure.

The question then is it possible to either authenticate using an alternate method/server for AD so I can have LDAP for sudoers and something alternative for passwd in /etc/nsswitch.conf?

Due to scale, maintaining local /etc/sudoers files for each guest would be administratively prohibitive and a step back in terms of architecture and scalability.

  • 2
    I would advise sssd. You can configure it to use multiple LDAP directories, so if a user isn't found in one, it'll try another. This will let you migrate as slow as you want. It works for authentication (pam) and sudo.
    – phemmer
    Aug 19, 2014 at 4:41

1 Answer 1


I can recommend a solution by using Univention Corporate Server (UCS). It is a Debian-based Linux enterprise distribution that integrates an Actice Directory compatible domain using Samba 4. So this could become the centralized Active Directory you are speaking of.

As to the LDAP issue, UCS also includes OpenLDAP. This means, you can integrate your existing Linux/Unix systems using the OpenLDAP of UCS and your windows clients/servers using the Samba 4 Active Directory.

Concerning the sudoers, there's a cool solution for sudo available that makes sudo configurable via the web-based Univention Management Console: http://wiki.univention.de/index.php?title=Cool_Solution_-_Setup_sudo_with_ldap_on_multiserver_environments

Or as another alternative, if you want to keep your existing Microsoft AD as the main directory, you can achieve automatic synchronization of users, groups and optionally password-hashes between this and the OpenLDAP directory of UCS via the in UCS integrated tool Active Directory Connection. This tool is available via the Univention App Center, which is also part of UCS by default.

Further information on UCS can be found within the a.m. wiki and at: https://www.univention.com/products/ucs/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .