Hacker News Reader

Comment by KronisLV | Hacker News Reader

What do all of the people who want to work with *nix in their infrastructure, but also want to utilize AD and LDAP use?

OpenLDAP? FreeIPA? 389 Server? ApacheDS? The project in this post? Or something else?

I mean, is it even viable to use something like that for most general purpose use cases, as opposed to caving in and going with something running on MS software/cloud platforms?

Which is the easiest to get started with and administer? Personally, I've used OpenLDAP in containers for a bit and overall the experience was pretty good. That said, I'm yet to see something as nice as Keycloak for managing a directory service (just something that you can setup in 15 minutes, that has a nice web UI and that has a wide variety of functionality).

View on HN

AFAIK (from messing with getting Linux to authenticate against a university AD system a few years ago) the best-supported way of replicating AD in Linux is FreeIPA on RHEL, since everybody less corporate is probably going to use a less corporate protocol

But Windows Server is IMO Microsoft's killer product. It's very good at what it does, although using it with Linux clients you'll be missing out on large parts of its functionality like GPOs, WSUS, etc

I've used FreeIPA with great success in the past. It really took care of the client onboarding and replication and hid all the ugly complexity behind it. UI was also pretty dang good.

> work with nix in their infrastructure, but also want to utilize AD and LDAP

If you have AD, just tell the nix machines to use it for user authentication? You don't need another server

If you want to utilize AD you don't have an alternative to run Samba, IIRC it's the only AD alternative that actually supports Windows clients.

For anything else, OpenLDAP in Docker.

> For anything else, OpenLDAP in Docker.

What about managing this instance and its configuration, as by default OpenLDAP doesn't really come with an easy to use set of tools/UI?

Would you use something like Apache Directory Studio (https://directory.apache.org/studio/) or CLI utilities?

It feels to me that OpenLDAP is probably more proven than lldap, but lldap seems to have a nice interface to use, much like Keycloak and some other turn-key solutions out there do (just a nice example to use from a slightly different domain).

Any form of LDAP management that is not Microsoft is an utter pain, and even Microsoft's is. It seems like the entire space has been stuck somewhere in the late 90s - horrible, outdated UIs and a bunch of dead projects that either don't run at all or are a walking bunch of security issues.

Personally, I use Apache Directory Studio because it's the least painful.

> IIRC it's the only AD alternative that actually supports Windows clients.

We only have 3 Windows clients amongst about 100 Linux VM's so we actually went the reverse path, OpenLDAP for Linux clients/servers and using pGina on the Windows boxes to connect it to OpenLDAP. Works pretty smoothly.

> What do all of the people who want to work with *nix in their infrastructure, but also want to utilize AD and LDAP use?

FreeIPA. A trust between the FreeIPA domain and AD means that AD users can log into Unix systems, it's great.

I had looked at FreeIPA, but support for non-Redhat systems seemed poor.

Samba is the way to go for AD on Linux, in my opinion. You'll likely want to run Samba (smbd and winbind) on the Linux clients as well.

Reply on news.ycombinator.com