- Jamf Nation Community
- Products
- Jamf Pro
- Re: Active Directory
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Active Directory
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-10-2013 01:55 PM
My Active Directory administrator (and his boss) refuses to allow the rest of our IT shop to use AD for anything other than an authentication tool. They refuse to allow it to be used for a corporate directory or ANY purpose beyond authentication only, with little or no reason as to why.
Can anyone give me insight as to why they would not want to allow Active DIRECTORY to be used for a directory?
11 REPLIES 11
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-10-2013 02:47 PM
I find a beer or coffee away from the office goes a long way when discussing infrastructure integration stuff. Most of the time the tower lead doesn't understand what you're trying to do, so they toss up a brick wall. Soft skills...
What were you looking to do? :)
--
https://donmontalvo.com
https://donmontalvo.com
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-10-2013 02:47 PM
dupe
--
https://donmontalvo.com
https://donmontalvo.com
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-10-2013 04:15 PM
It is possible your boss is looking to keep costs down by not having to invest in licensing for either users or computers. Microsoft is good about getting paid.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-10-2013 07:27 PM
Dumb question...
Did you ask why?
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-10-2013 09:07 PM
No one can read their minds and they can't read yours. Like don said relaxed chat away from office is best.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-11-2013 04:53 AM
We want to have one authoritative source for employee data. Something as simple as an employee directory with phone number, office location, job title, supervisor, etc… has to be extracted from multiple sources now (so consequently isn't happening). AD contains the user's LAN ID, email address and Real name. That's about it.
When we ask for more, the reason given is "We don't believe AD is the place to do that."
Fair enough. "Why not?"
"Because we said so…" is about as close to an answer as I can get.
So I am looking outside my data center to see if they have legitimate reasons not to want to do it. If they do, great, I am not hell-bent I am right. But I am hell-bent to find out if they have a legitimate reason. If so, I am more than willing to push for our organization to use best practices.
If Peoplesoft is the place to put this information, fine. But most applications can't (out of the box) pull from Peoplesoft. I want AD to pull in data from Peoplesoft and the phone system so it is available to applications.
I have been completely open about what I want to do. They don't have to try to read my mind…
Sincere question: Is this asking too much?
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-11-2013 05:32 AM
Kevin,
With regards to your "Is this asking too much?" question, that's going to be a political question. If the folks who would need to implement the change really don't want to implement the change, you need to either A) back off, B) find some policy or regulation that says that they need to make this data available, or C) go over their head and hopefully find someone who will both listen to you and can make them implement the change you want.
Note: There's also D) passive-aggressive whining, which is what some folks do in place of choosing A,B, or C, but that's not really helpful to anyone.
As for the technical part, you can update AD fields with information from PeopleSoft. See here for a 2010 MS forum thread discussing ways to bulk update AD with info from PeopleSoft:
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-11-2013 05:43 AM
Sincere question: Is this asking too much?
No, I don't think so, but (at least in my experience) IT organizations generally fear change. Especially when that change is in the wheelhouse of someone who is nervous that you're getting into an area of expertise that they don't know enough about. You're not the one who is going to have to execute this transition and the person who is may not feel comfortable in their skill set.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-11-2013 06:02 AM
I'm admittedly not an expert on the subject (I'm just now learning some things about AD, having avoided it for years...) but - office politics aside - would it be possible to use an OpenLDAP overlay to connect with AD and extend the records with the additional user info, then have your applications look to OpenLDAP for their data?
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-11-2013 06:21 AM
Sure, you can do that, but it begs the question:
Do you really want another directory service? They don't maintain themselves...
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Posted on 01-11-2013 08:28 AM
Unfortunately it looks like you're just going to have to find a social solution to this one. I second the suggestion for coffee/beer/lunch with someone who can make those decisions. Finding a technical work around will only cause extra work/headaches and add another thing for 'Murphy' to play with in the future.
