Active Directory authentication for SaaS product

Question

After some theoretical help on the best approach for allowing a SaaS product to authenticate users against a tenant\'s internal Active Directory (or other LDAP) server.

Answer 1

What about an LDAPS connection to the customer's user directory? They can firewall this off so that only your servers have access if they're concerned about it being public. Since it's SSL it's secure end to end. All you need from them is the certificate from their issuing CA (if it's not a public one). I struggled to get this working for an internal web project in the DMZ and there's a real lack of any guides online. So I wrote one up when I'd got it working:

http://pcloadletter.co.uk/2011/06/27/active-directory-authentication-using-ldaps/