0

I'm currently into a process of creating a central service system from where users can connect to VMs. My goal with this is to have a single point of authentication for all possible users.

The issue that i'm facing is :

I need to split the users into 2 different LDAP servers (internal and external users). Now, the LDAP configuration itself is not difficult and it does not have that many users (maybe 20 on each server). This is not a redundant system, there are 2 independent LDAP server, each hosting a different category of users. The UIDs and GIDs will be unique, even the name of users will be different (internal users from external users)/

Is there a way to check the UserAccounts on both LDAP servers before the connection is made? A main requirement is that users will have a unique UID and GID and they will be using SSH keys.

Ideal case would be:

  1. Users login on the Central Service
  2. User is being checked on Internal LDAP
  3. If he is not part of this, user is being verified with External LDAP (the second server)
  4. If he is not part of this server either, system kicks out the user.

I have seen a post related to my question here :

https://serverfault.com/questions/106869/how-can-i-proxy-multiple-ldap-servers-and-still-have-grouping-of-users-on-the-p

How can I proxy multiple LDAP servers, and still have grouping of users on the proxy?

However I'm not fully sure if this applies to my situation of if there are other ways to make this happen.

I have also found in my research that using nslcd would also be a solution.

Kindly awaiting four your assistance.

Thank you in advance.

Adrian

0

OpenLDAP allows you to have several backends. You could define one real database with back-mdb and two proxy backends with back-ldap. Of course you have to use a different DB suffix for all of them.

With this configuration you can let this OpenLDAP server act as LDAP proxy while also creating local group entries. In these group entries you can put DNs of the LDAP backends as member.

P.S.: Could you please elaborate on why you need two separate LDAP servers?

  • Hi Michael, thanks for your assistance! Indeed this option makes more sense than my idea, as I cannot find any option to configure a proxy within the LDAP config file. However, having another LDAP that only works as a proxy, might require additional administration/configuration but if it's a suitable solution then it's what I should be looking into. Thank you for your assistance, I will update this thread once I configure my servers. – Adrian Jul 23 '18 at 14:34
  • Regarding your question, unfortunately, I do not have enough details for the reason behind this decision. It could be just political disputes between the stakeholders (there are 2 departments involved and each one has their own vision of how their users should be managed). – Adrian Jul 23 '18 at 14:37
  • Still the two departments could have separate databases on one LDAP server or two different subtrees in one database with different ACLs. You should try to clarify the hard requirements (pointing out what's needed in case they insist on having two separate servers). – Michael Ströder Jul 23 '18 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.