OpenLDAP migration: OpenLDAP from an Active Directory schema

OpenLDAP migration: OpenLDAP from an Active Directory schema

I'd like to transition our user provisioning from Active Directory to OpenLDAP. I was planning to install OpenLDAP on Ubuntu. Is it possible to move all AD users to OpenLDAP?

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

Yes, from Active Directory it is possible to perform an OpenLDAP migration on an Ubuntu or other operating system, but you'll need to use an intelligent transfer program like a virtual directory or meta-directory to do it. Flat-file synchronization generally is a lot of work, since the data migrates but the access controls do not (something virtual directories and meta-directories do carry over).

First, you must map the OpenLDAP schema to the current Active Directory schema. Next, the OpenLDAP user object must be extended to include all the fields used in Active Directory. Once the mappings are done, you'll need a transportation method, either a flat-file synchronization program or a meta-directory. For synchronization you'll extract the Active Directory user objects into a flat file (usually comma delimited), then run an import synchronization that takes the flat file and imports the content into the OpenLDAP schema. If a meta-directory is used, you'll create real-time connections between the Active Directory server and the OpenLDAP server.

The mappings done in the previous step are then used to configure the connectors. Finally, a meta directory update is done and the Active Directory will send out a "replication" that maps to the OpenLDAP schema, as defined by the meta directory, and automatically populates the OpenLDAP server.

This was first published in June 2010

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.