Hacker News Reader

Comment by dingaling | Hacker News Reader

AD is fairly well known due to its relationship with LDAP and Kerberos.

Samba can act as an AD DC.

AD is incredibly more popular than Kerberos despite part of it using the protocole. Microsoft is everywhere in the corporate world and most people know of AD but have never heard of neither LDAP nor Kerberos.

And to be honest, it's fairly understandable. AD manages to be somewhat turnkey while doing the same thing on Linux systems is a major pain.

What is the usual way of doing this on Linux systems?

OpenLDAP and SSSD via PAM. It’s - well - let’s leave it at not very nice to put in place. It does the job once there however.

I am fairly convinced that Redhat, Novel and Oracle probably have a nice interface on top of it all to make it manageable and therefore have a vested interested in keeping it as awful as possible for the rest of the world.

Every time I've ventured into it I ended up using Samba to pretend to be Active Directory vs LDAP + Kerberos ...

Using ‘ldap+kerberos’ is like saying your api is ‘rest+tls’. It is a protocol/format. The value in AD is how the format is used and its impact on systems and users. So yes, Samba sounds more sensible.

When I played with it I stayed away from self-managing something like it for linux-only systems and for mixed/cloud/online systems I use Entra Id

I don't know what Active Directory, LDAP, Kerberos, or AD DC are. I've at least heard of Active Directory though! The programming industry is vast. I've never touched webdev so I don't know countless things that most programmers know.

Best part is, Active Directory, is not webdev related at all. :)

Active Directory, is not webdev related at all.

If you work on internal company systems in a Microsoft environment it often can be.

It can be when you're supporting AD authentication on an intranet site. I did a bunch of these for government type web apps. Not the most fun to be sure.

Reply on news.ycombinator.com