title: Active Directory authentication for SaaS product
body: <p>After some theoretical help on the best approach for allowing a SaaS product to authenticate users against a tenant's internal Active Directory (or other LDAP) server.</p>
  
  <p>The application is hosted, but a requirement exists that tenants can delegate authentication to their existing user management provider such as AD or OpenLDAP etc.  Tools such as Microsoft Online's hosted exchange support corporate AD sync.</p>
  
  <p>Assuming the client doesn't want to forward port 389 to their domain controller, what is the best approach for this?</p>