Re: Is is possible to have Active Directory use a different LDAP server for logging in users?

It is if you can kerberize the Tivoli stuff and make it into its own realm (i.e. like a domain). Then you tell AD to trust that realm and it will be similar to using another trusted domain.

Otherwise no, LDAP isn't a good auth mechanism and isn't an auth protocol at all despite the fact that people use it for that. Windows uses kerberos for Auth because it is a true auth protocol designed specifically for that purpose.


--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Ian Becker wrote:
In our current environment, we have a Tivoli Directory server that is
our main LDAP server, would it be possible to have Active Directory
pass through logons to that to authenticate users without actually
replicating the databases?

Thanks,
Ian

.