[ActiveDir] Identity Management using AD

[Glenn Corbett]

All,   We are in the process of redefining our Internet-enabled applications with a view to a centralised customer/client database.  There has been quite a bit of discussion regarding using AD as this "customer store", since AD will already be in this environment.   I'm a bit hesitant to recommend "vanilla" AD for this task, however I can see a number of benefits to this approach, as the support monkeys can manage the entire environment using the same tools they use to manage the production environment (ADUC etc).   I've been reading up on the information regarding MIIS (what little there is), and can see some potential for a configuration such as this, eg:   - Use AD to store the "core" customer information (user name, password, basic details) - Use ADAM or SQL (or whatever) for each application to store application specific extensions (so I don't end up with a blown out schema in AD with thousands of additional props for user objects) - Use MIIS as the Authentication / Identity management front end, and use it to sync these disparate databases to ensure some semblance of "sameness" between them. - Also use some of the MIIS features such as provisioning etc to ease the management overhead.   Applications could use AD to authenticate the customer coming in, and then use their ADAM database to house the application specific information they need.   We could possibly then use MIIS to "backchannel" into the production AD system, so that corporate users can gain access to these Internet applications without requiring multiple accounts.   This is all just brainstorming at the moment, however (as usual), I need to come up with some sort of design by next week (gotta love being given lots of time *grin*).  Having not actually got my hands on MIIS, this could be completely unfeasible.  Other options are a custom database for the "customer store", or some other existing product.   Has anyone been down this road before, and could share some insights / resources ?   Thanks   Glenn