Is it possible to setup a ?Mini-ldap? directory that trust a larger LDAP entity?
Details: Our university host a large LDAP environment (Active
Directory) that is used by several internal organizations (all having
separate OU?s). Since we are a health care provider, we are very
sensitive to HIPPA security, hence, we don?t create user accounts in
our AD to be used for non-university type people (such as vendors,
patients, customers, etc.).
When we build applications that are available to these non-university
types, we are forced to use local authentication methods. One example
is our streaming video of Grand-Rounds, which we use ADAM (a mini
lightweight LDAP from Microsoft) for authentication. The problem with
this is when the end user IS a university type, we have to give them
yet another user account and password to use theses applications that
are open to both types of people.
What I would like to do is somehow integrate my small LDAP with the
larger one, with some type of one-way trust. For example, my ADAM
directory could trust our larger university AD, but the large AD would
not trust my ADAM directory. Also, can the two directories coordinate
somehow so that usernames between the two are not duplicated?
If this is possible, I would need the appropriate terminology to
explain my request to the administrators of the larger AD, in such a
way as to explain the benign nature of such a scenario.
We would be happy to tip for very complete answers and clarifications.
Thanks |