Using directory services in an AD resource forest

Tobi_Oude_Breuil

We are currently busy connecting our Livelink 9.7.1 testserver to Active Directory 2008 (AD). We installed the directory service module and read the manual.But we have an AD installation that consists of an account forest and a resource forest. How can we connect Livelink to a resource AD configuration?We not only want single sign on but also manage some groups in AD instead of Livelink.Anyone has the same AD design?

Dick_Muller

Hi Tobi,I would think you can make a binding with one of the LDAP AD server in the resource domain. Your root however where it can find the accounts and groups is an LDAP DN to the account domain.Your search filter also uses LDAP DN's that point to the account domain.Synchronizing the groups is possible. If a user is member of a several groups this will be synchronized also.If you want to synchronize nested groups I think you have to use the Group Member Query. And that one can only be used if you choose for LDAP Read/Write.So it depends on what you want to synchronize.If you want to use LDAP Read/Write you need to make adjustments to the AD schema. One of them is the llquery attribute for AD groups that need to be synchronized. You can configure this attribute with an LDAP filter explained in the documentation, for example (&(ou=Accounting)(l=Chicago)).Kind regards,****