My problem is that I have a number of network administration applications like SAN switches that do not support nested groups from Active Directory Domain Services (AD DS). These legacy administration applications use either LDAP or LDAPS.

I am fairly sure I can use Active Directory Lightweight Directory Services (AD LDS) and possibly Windows Authorization Manager to work around this issue; however I am not really sure where to start.

I want to end up with:

• A single group that can be queried over LDAP/LDAPS for all it’s direct members
• LDAP proxy for user name and password credentials to AD DS
• Easy way to admin the group, ideally the group would aggregate the nested membership in AD DS.
• a native solution using freely available components from the Windows stack.

If you have any suggestions or solutions that you have previously used to solve this issue please let me know.