RE: [ActiveDir] Publish ldap externally

[Wehner, Paul \(wehnerpl\)]

Title: RE: [ActiveDir] Publish ldap externally

My initial idea too complicated and political.

We're going to deploy a separate ldap (novell) server for trusted external entities.

 

 

 

---

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Geldrop, Paul van
Sent: Thursday, September 15, 2005 9:52 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Publish ldap externally

ADAM in a DMZ, perhaps ?

 

Allowing LDAP queries into your domain sounds risky to me. Proxying into your own AD gives me the chills, quite frankly :P

 

Another option might be to extract the data periodically through a script and publish it to a secure webpage, like Al suggests. Bit more work, but also much more secure imho.

 

Regards,

 

Paul.

 

 

---

From: [EMAIL PROTECTED] on behalf of Al Mulnick
Sent: Thu 9/15/2005 3:44 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] Publish ldap externally

It is, but have you considered an alternate method? Maybe a secured web page vs. 389 access to the network?? A web service? 

What are the risks that you see in your organization and are trying to mitigate vs. the rewards? How real-time does this need to be?

Allowing access is easy.  Doing it in a way that meets your risk tolerance and return on time spent is different and requires a better understanding of your goals and environmental factors.

Al




-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Wehner, Paul (wehnerpl)
Sent: Thursday, September 15, 2005 9:35 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] Publish ldap externally



We are an edu and have an outside entity requesting access to our exchange 2003 address book.
I was thinking about creating a proxy user and giving it limited search rights in AD (name, email, phone, dept) and acl'ing 389 to the other orgs network.
Is this possible?

Thanks,
Paul




List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/