One user, one password: integrating unix accounts and active directory

ABSTRACT

The University of New Hampshire has a history of using centralized Unix accounts to authenticate user access to computers in the public Student Computing Clusters. The advent of Windows 2000 meant that changes would be necessary to support the Active Directory architecture underlying Windows 2000 authentication and authorization. Given limited resources, manually maintaining Active Directory accounts for over 12000 students is an impossibility. A new system was needed to automatically generate an Active Directory account for each and every Unix user and to synchronize password and other account information with as little system administrator intervention as possible. Using a combination of technology from Microsoft and various scripts developed within the UNH Computing and Information Services group, we have created just such a system. For every newly created Unix account, an Active Directory account with an identical user name is generated. Password changes on the Unix systems pass the corresponding password update to the Active Directory domain controllers to assure that the accounts remain synchronized. This system has functioned for a full academic year with only minimal issues. With this infrastructure in place, we hope to be able to leverage it in other fashions.

REFERENCES

• 1: Active Directory Service Interfaces. http://msdn.microsoft.com/library/en-us/netdir/adsi/active_directory_service_interfaces_adsi.asp.
• 2: Alistair G. Lowe-Norris , Robert Denn, Windows 2000 Active Directory, O'Reilly & Associates, Inc., Sebastopol, CA, 2000
• 3: Samba. http://www.samba.org/.
• 4: Samba Development Road Map. http://us1.samba.org/samba/development.html.
• 5: Services for Unix. http://www.microsoft.com/windows/sfu/.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Authentication

General Terms:
Management, Security

Keywords:
Active Directory, Unix, Windows 2000, accounts, authentication, integration