i am looking for a way to replace MS AD. So i came across this document that kinda does it: https://help.ubuntu.com/community/SingleSignOn#Login_Manager_Configuration
but i would like to further lock down user desktops like it is described in this post: https://wiki.ubuntu.com/Specification/ConfigurationLockdown
How can i apply dconf profiles per ldap group? -is it possible to store them on a network share?
How can i apply locks per ldap group? -do i need to push them to "/etc/dconf/db/'database'.d/locks" or can i have locks on a network share?
How does dconf handle profile/lock updates?
Is there a best practice document that could help me?