Then we will be configuring a pass-throughĪuthentication between OpenLDAP and AD using saslauth demon. Pass-Through authentication is purely transparent for LDAP clients, as they send standard authentication operations to the LDAP directory, which will then handle the delegation and forward the response to the client, as the authentication was done locally.įig: 1.1 – Password is stored in a AD and OpenLDAP directories delegate authentication to it.Īdding the actual user profile in our locally installed (on CentOS 7) OpenLDAP Pass-Through authentication is a mechanism used by some LDAP directories to delegate authentication operations (BIND) to other backbends. Authentication mechanisms can also support proxy authorization, a facility allowing one user to assume the identity of another. It decouples authentication mechanisms from application protocols, allowing any authentication mechanism supported by SASL to be used in any application protocol that uses SASL. Simple Authentication and Security Layer (SASL) is a framework for authentication and data security in Internet protocols. – LDAP is one of the protocols you can use to talk to it. – OpenLDAP is again a directory services database in a Linux environment. – AD is a directory services database in a Windows environment. LDAP (Lightweight Directory Access Protocol) is an application protocol for querying and modifying items in directory service providers like Active Directory, OpenLDAP, which supports a form of LDAP. It is released under its own BSD-style license called the OpenLDAP Public License.Īctive Directory is a database based system that provides authentication, directory, policy, and other services in a Windows environment OpenLDAP – OpenLDAP is a free, open-source implementation of the Lightweight Directory Access Protocol (LDAP) developed by the OpenLDAP Project. Then the saslauth daemon performs the authentication on the Active Directory server using the LDAP protocol.īefore we begin, let’s ensure we are good with the terminology used in this document and its definition. The idea is to ask OpenLDAP to delegate the authentication using the SASL protocol.

Ldap pam centos 7 active directory