Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm going to be setting up LDAP on Ubuntu in the near future, and I have a few questions. First, let me start with our desired structure. We have an ActiveDirectory server and an Ubuntu server. We want to have both of these be LDAP endpoints, but with a catch. Anything we put in our ActiveDirectory should sync to the openLDAP server, but not vice-versa. There will be new entries added to both endpoints as well, so just doing a one-way sync might not be the best.

We want to do this because we want the company employees to be on the ActiveDirectory, and only the employees. We do, however, want clients to have some level of access and we intend to establish that through the openLDAP server.

I'm a programmer by nature, so I'm not sure how feasible this is, but I imagine it's possible. Would anyone be willing to detail how I could go about accomplishing this? Or is this how the LDAP sync would work normally? I can't forsee us having any collisions between the two endpoints either - I think it's safe to say the username will always be unique.

share|improve this question
I'm having troubles understanding why you would want to such a complex scenario with a semi sync just for this. Why not just give your clients access to just a part of your Active Directory with ACLS instead? – tomodachi Aug 20 '14 at 13:32
@tomodachi I'm describing it as the network admin wanted to implement it. I didn't have any say in implementing it, just that it had to be done. – Seiyria Aug 20 '14 at 13:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.