Match different Active Directories

[sla82]

Whe have 2 Active Directorys. In one site we want to deplay a postgesql server. We need to synchronize groups and user from both ads. Ist this possible?

URI1= xxx.yyy.loc
URI2=yyyy.bbb.com

With ldapsearch i can search in both ads. But with ldap2pg but with ldap2pg I unfortunately can't do it

[bersace]

Hi @sla82 . Can you share the ldapsearch command ?

[sla82]

Hi @bersace , sure. here are the commands.

AD1:
ldapsearch -H ldaps://DC1.XXX.loc -x -LLL -D "CN=pgldap,OU=User,DC=XXX,DC=loc" -w 'password -b "dc=XXX,dc=loc" "(objectClass=person)" samaccountname

AD2:
ldapsearch -H ldap://AA-DC-01.bb.YYY.com -x -LL -D 'CN=PGLDAP,OU=User,DC=bb,DC=YYY,DC=com' -x -w 'password' -b DC=bb,DC=YYY,DC=com '(objectClass=person)' samaccountname

[bersace]

Since you need two calls to ldapsearch, you'll need two calls on ldap2pg. ldap2pg behaves like ldaputils. It synchronize from a single directory to a single Postgres instance.

You'll have to ensure each ldap2pg run don't clash with other by implemented ad-hoc managed_roles_query to exclude roles managed by the other. I.e. keep track of the source AD of a role and restrict managed_roles_query to managed roles from this AD only.

[sla82]

How can i do two calls on ldap2pg with different URI, BINDDN, BASE & PASSWORD?`
Can you provide an example?

[bersace]

How can i do two calls on ldap2pg with different URI, BINDDN, BASE & PASSWORD?` Can you provide an example?

Execute ldap2pg with two environment variables set.

$ LDAPURI=ldaps://dc1 ldap2pg
$ LDAPURI=ldaps://dc2 ldap2pg