As part of an undergoing IT infrastructure building, I need to implement LDAP directory using opensource communities backed solution.
I'm not pretty sure about Openldap and Samba. Do they offer roughly the same features as Active Directory ?
Any insight will be appreciated.
Open Source – Alternatives to MS Active Directory
active-directoryldapopen source
Related Topic
- Ldapsearch against Active Directory fails authentication + search params wrong
- Ssl – Active Directory Certificate Import Successful, but LDAP Authentication Still Fails
- Ldap – Managing Linux user accounts + Samba + more
- Active Directory – Common Wisdom for Linux Servers Authentication
- Windows – OpenLDAP and pGina vs Active Directory (Using Samba4 Domain Controller)
- Ldap – Is it possible to have Windows and Linux machines use the same LDAP server
Best Answer
Starting with v4.0, Samba is (or can be):
The most compelling use case for Samba4 is if you want (most of) the benefits of a Windows domain but don't want to use Windows server, either to save on licensing costs or because you want to stick with a Linux-based infrastructure.
If what you're looking for is just an LDAP directory server, it doesn't really make sense to use Samba4. If you want LDAP for a bunch of non-Windows applications to authenticate against, you're probably better off with OpenLDAP.
But if you want LDAP and need to support Windows clients, Samba4 gives you many of the same domain functions of Windows server:
How well do all of these work?
Basic Windows client functionality - very good. PCs join a domain and log in the same way they would with Windows servers.
Server management - good. You need to use both the Windows RSAT tools and the Linux command line to manage Samba4. You can do most day-to-day things with the RSAT tools (e.g. AD Users and Computers), but need to edit smb.conf to add shares.
If you were going to use Samba4 just as an LDAP server, you'd probably still want to use the RSAT tools to manage it.
ACLs - In theory you can manage ACLs from the Linux side, but in practice forget it, you need to right-click and select properties/Security. You can create ACLs using any or all of the groups you create in ADU&C.
Group Policy - good. I don't have much experience with Group Policy in a purely Windows environment, but in Samba I found that everything seemed to work. We customized desktops, deployed printers, installed software.
One notable limitation of Samba is that you have to set up your own directory replication. In a Windows domain, the sysvol share replicates between DCs, but with Samba you need to set up rsync or something to handle the replication.
But note: Samba won't replicate to OpenLDAP servers. The way AD implements LDAP and replicates is too different from the way OpenLDAP and other open source LDAP server work, so the Samba team only supports AD.
Support
You have fewer options for support with Samba4 compared to Windows server. With Samba you'll need to become familiar with the Samba wiki. There are lots of tutorials around, but the Wiki is almost always the most accurate source. If you implement Samba, you really should join the mailing list and learn how to search the mailing list archives.