JohnS wrote:
What I'm looking for is a network service that will work across apache and java web services (without requiring a login account) that transparently merges AD accounts with others that I can control separately, and also to be able to use those same logins and passwords for linux system logins where accounts are specifically created. That is, all AD & linux accounts should work for web services and Linux account logins should be able to use AD passwords where they exist.
I'd think this would be a fairly common situation where the bulk of company operations are on desktops controlled by AD but there are some developers using Linux and some infrastructure resources using it (subversion, wikis and other web services, etc.) and some users that don't map to employees.
Web Services via SOAP can be your "Middle Ware" (man in the middle) to authentication here.
I thought that was what PAM was for. I just don't know how to glue it into someone else's java web app (like OpenNMS or Pentaho's server).
Your AD admin is going to have to help out in some way for this to happen. No way around it I see.
He doesn't now, using PAM with both smb and local password authentication.
Anonymous accounts can be mapped to the the appropiate AD account (IWAM_User - depends on service app). Firefox can use the LDAP Plugin, Apache auth can be mapped to LDAP on AD. Once an AD account is locked out he will know anyway.
I don't want anonymous accounts. I just want to be able to add some that are unrelated to AD, but I'd prefer to not have to add them to every machine.
Maybe check out MS Web Services Interface and WSDL for AD. It is just something to really sit down and think about authentication between mixed node systems. Can it be done? Yes. One other solution here Enterprise wide would be Citrix.
I think PAM with smb and ldap would sort-of work but it still doesn't seem like the right approach and so far it has been easier to manage a small number of exceptions on a small number of separate machines. I thought there were LDAP servers that could proxy for multiple other servers where some of those might be AD's.