How do you authenticate a cloud service against a local Active Directory?

Is there a stand开发者_运维问答ardized way to set up AD authentication for a web service that does not have direct access to the AD controller? I'm thinking of a cloud application such as Google Apps that wishes to authenticate against an organization's AD.

I have googled around quite a bit but I don't seem to know the right keywords. Maybe someone else can elighten me or give me some search pointers.

FWIW, our applications are written in PHP using Zend Framework.

The most elegant solution to your problem would be using identity federation. The basic idea is to authenticate your user locally like you do on your regular apps and send a security token to your cloud provider, proving the identity of your users. SAML is the most common federation protocol used for achieving this. Google has a nice page explaining the details and the wikipedia page is also insightful:

There are plenty of identity federation solutions, for example:

• Active Directory Federation Services (ADFS)
• SimpleSAMLphp
• Shibboleth
• OpenAM

SimpleSAMLphp may be a good start to familiarize with SAML, as it is.. simple :) The procedure to connect it to google apps is described here.

ADFS would be an AD-centric solution, but is a bit more complex to configure.