We have a situation where our organization is represented as an OU in
the overall corporate directory.
We have our own admins for the OU, however the Enterprise Admins for
the corporate AD reside elsewhere( in a diff country).
For some reason we are not comfortable with the EA's and do not want
them to be messing around with the users and groups within our OU.
However I understand that in AD, forest is a security boundary and
there is no way one can prevent EA's within that forest. Moving out of
the corporate forest and creating one AD forest for ourselves is not
an option with us due to the expense involved.
The issue is that we have a certain application which we want to guard
and donot want any other to launch it except one of those within our
OU. At present AD users would simply launch this app, it would check
whether that user belongs to one of the groups in our OU , if yes it
will run under the context of the user and perfrom its work. Here is
the EA's can create a user and add it to one of our groups and gain
access to our application.
Also this application unfortunatley needs windows tokens to work i.e.
an ADAM logon token wont work.
We are thinking of using ADAM ( inexpensive to maintain ) and
exporting all our users and groups from our OU in AD to within ADAM.
The user name and passwords of ADAM users will be known to our ppl
only and being a diff boundary the corporate directory EA's wont be
able to get in.
We can then require the users to launch an application x whcih would
authenticate against ADAM , if successful that application would lauch
our application but it does so in a manner that the second application
gets launched under the context of a AD user. That is the first
application x verifies the user name and password against the ldap
store in ADAM , if successful some kind of programming converts this
to the AD logon token of a respective user in our OU in the AD and
then launches the hidden application under the creds of AD user.
I dont know whether the above made any sence but any help is
appreciated.