I´m trying to extend Active Directory(ADS) with OpenLdap.

I can access to ADS for search, but not to modify it. So I´m trying to configure OpenLdap to extend information of ADS.
Ex: Create new groups in OpenLDAP with users of ADS.

1- ¿Is it possible? ¿Any reference/documentation about it?

2- Is possible that Clients connect to OpenLDAP and information not found in OpenLDAP be searched by server in DAS?

Thanks

nope. why would you want to do that?? you can extend AD with AD schemas and you could arbitrarily add information in which you could refer to other groups, but it'd be your call to use that information.

I can´t modify ADS. I´m only a DAS user (can´t administer) it.

well TBH then it would seem that it's not your place to want to mess about with it... what do you really want to achieve??

Thanks for your reply.

My English isn´t very good but I´ll try.

My company use DAS (Active Directory) as repository for all the users accounts. I´m the manager for some applications. The ADS contains a lot information, but not all I need. And I access it with ldapsearch command, but can´t modify it (or I can modify a few objects only).
So what I try is to extend the LDAP with another LDAP (if possible, Openldap). Ex: I´want to create groups in my ldap (OpenLdap) with users of DAS.
What I try is to inquire OpenLDAP. If information is stored there (openldap), it directly returns me the information. If information is stored in ADS, it inquires the ADS and returns me with the information.

I´m trying with referral, but not sure if it´s possible.

Also, i´d like to use the login/password of the DAS to connect to OpenLap (suppose it´s possible with kerberos. isn´t it?).

Regards

Felipe

Does any know if it´s possible to use this objects to get it? How can be possible?

superiorDNSRoot
crossRef

Thanks

you would need to query the AD with your take, take out what you need and then in isolation go query your openldap server totally seperately.