Slashdot Mirror
Searching for a Directory Service Solution?
kumulan wonders: "I've got the responsibility to set up directory services as well as a messaging/groupware system for my organization of app. 100 employees spread out over three locations. We are a startup that is merging three existing smaller companies and, given the state of existing IS infrastructure at each of these locations, the decision has already been made that we are better off starting from scratch. It would be great to hear from Slashdot readers concerning which option is 'better' and why."
"For me, the choices are stark and clear:
- MS Exchange/Active Directory
- A cobbled-together solution based as much as possible on OSS (as no direct equivalent exists).
- Samba/OpenLDAP/Kerberos
- Bynari Insight Server for messaging/groupware.
- Nitrobit Group Policy for, you guessed it, group policy management.
It's a standards based (LDAP) mail/groupware app which supports standard SMTP/IMAP clients as well as Outlook/Palm clients (for an additional fee).
Seems competitively priced to Exchange and there's also a free pure OSS version available (although if you want offical support and a nice installer, you need to pay for it).
http://www.openexchange.com/
I haven't personally used it, but I've been looking at it as an Exchange alternative (I really really hate exchange) for the small company where I work.
Other Options to Consider:
o ntent/
Novell:
Linux Small Business Suite
http://www.novell.com/products/linuxsmallbiz/
It includes edirectory, groupwise for email, suse enterprise server,Novell ZENworks Linux Management Client
IBM (Lotus)
http://www.lotus.com/lotus/general.nsf/wdocs/nd7c
You can use Domino as an ldap server.
Other IBM Software on Linux:
http://www-306.ibm.com/software/os/linux/software
or
http://www-1.ibm.com/linux/matrix/
I don't know what your selection criteria are, but it seems to me that you have another choice: Novell's products. More specifically:
1. Directory Services: eDirectory. It runs on multiple OS platforms such as Windows, Linux, NetWare, Solaris, etc. It is more robust than AD, particularily across wan links (viz. replication). And of course it is LDAP v3 compliant so nearly any LDAP client can use it for authentication and authorization.
2. Open Enterprise Server, Linux and NetWare. For hosting your file and print services. You get the best file system out there - NSS - on either platform. Real ACL's and vastly more refined trustee assignment and inherited rights filtering capabilities than any other filesystem.
3. Groupware/Messaging: I am less experienced in the alternative offerings in this catagory, but I believe that Novell has a decent product in GroupWise 7, which runs on Windows or Linux or NetWare.
Again I don't know what your selection criteria are, but you may have skipped Novell due to lack of awareness...
Cheers.
Try XAD from PADL.
To Windows clients, it acts as an Active Directory domain controller, so it supports Kerberos authentication, group policies, etc. It also includes RFC 2307 support for seamless integration of Linux/UNIX clients.
It's all still there, it's still viable, it's still better then what MS offers, it's still cheaper then MS.
Just because something doesn't get a lot of press doesn't mean it's gone.
evil is as evil does
That's what I thought when I read the requirements. Netware (or whatever they are calling it now that it runs on Linux) and Groupwise should be all you need.
I don't know about cost. We have their educational license, and that includes Netware and 3 other products (we use Groupwise, ZENworks and iFolder) for less than $3.50 per student. The license covers as many servers as we care to run those products on.
- GroupWise Migration Utility 2.0.1 for Microsoft Exchange
- GroupWise PDA Connect 1.0 SP1 Multi Lingual
- GroupWise Import Utility 2.0 for Microsoft Outlook
- GroupWise Gateway 2.0 for Async Connections
- GroupWise Gateway 3.0 for Lotus Notes
Just check out Novell to see some of their products (no, I do not work for Novell, I just like some of their products).Also, there are some really great LDAP/IMAP type solutions you can put together under Linux for zero cost. Obviously this option requires someone more capable than your typical point-n-click "MS-Admin". It would take one employee with the ability to read a book or some docs. Though, I know your typical point-n-click "MS-Admin" wants to be able to just put in a CD and let AUTO-RUN do all the "hard" work for them.
If I personally owned a small company with ~100 employees, I would rather have one talented admin that could handle *nix/Win than 2-3 point-n-click MS "admins". If you added up the salaries, that one guy would cost you less than the 2-3 less capable point-n-click MS "admins". TIJMO (This is just my opinion).
If Tyranny and Oppression come to this land,
it will be in the guise of fighting a foreign enemy. -James Madison
I've just started to take a look at Fedora Directory Server. It is very easy to set up and with the GUI manager, it seems about as easy to manage as Microsoft AD.
I think you are missing more than a few options there.
t his-second tends to run well directly out-of-the-box without the need for much in the way of expertise, in smaller environments. I would call this directory the defacto standard (although this statement may now be obsoleted by the advance of AD - hard to say). If you are using other SUN infrastructure, or if you are using the Sun Calendaring/Messaging product (which I would recommend as a very solid alternative to MS exchange), this DS is an excellent choice.
IBM has directory services.
Sun has directory services.
Novell has directory services.
My thoughts:
- the problem with IBM's directory is that it sits on top of DB2. This abrogates one of the coolest parts about directories - that you don't need a DBA. And a mistuned IBM directory is an ugly, ugly thing.
- the Sun/Netscape/iPlanet/SJSDS-whatever-they-call-it-
- Novell - well if you are a Novell shop, you will use NDS. You will use everything else Novell has. It is sort of like joining a secret cult.
- OSS - I would consider this an advanced option. My suggestion is, if you know nothing about directory services, that you would be better off with something a little more... packaged. I'm sure many here will rabidly disagree with me, but I certainly would consider that choice as risky. A second issue is that many LDAP-enabled products that you may wish to run on top of your directory layer (provisioning, WSSO, etc) only support commercial directory servers.
- Microsoft - well, you're probably going to have to install this one anyways, in order to get a LAN. Although I'm a unix chick at heart, I must admit that I have seen many well-run AD directories. If you aren't already in the UNIX world for any good reason, AD is probably a logical direction. Many many companies have cut their directory services teeth this way. The disadvantage is that your Enterprise Directory is also your NOS, which can be a pain from a licensing perspective, if you want to store authentication-only users as well.
FWIW, hope that helps...
don't mess with those geekgrrls
Anyways, let us examine the different components and see how far OSS can take us. Maybe it can't go the whole journey, but if it can do some, then a hybrid solution will work.
Open Groupware, SuSE's Open Exchange and OSER will handle the Exchange part, including support for all those MS Exchange clients, such as Outlook.
That just leaves the Active Directories part. ISC's DHCP supports Dynamic DNS. However, you may want to add in DHCP2LDAP to get a good link between DHCP and BIND. OpenLDAP provides the LDAP implementation part. Kerberos and DNS are easy (although some may quibble with my choice of Kerberos version!)
Provided you're not planning on having both MS Active Directory and the above amalgam running, you should then be set to go with a comprehensive Active Directory lookalike which will interact with client systems in the same way Microsoft's software will.
The problem I found is that there's almost no way of getting from a Linux solution -to- Active Directory. If AD is present, it must be a root server, which Linux CAN pull from.
Do I recommend this kind of a setup? Probably not. The Exchange and Groupware stuff should be fine, but the Active Directory stuff isn't as coherent as it could be and I've heard of nobody who has completely replace AD with an Open Source solution, even though from a purely technical perspective it should be possible.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Actually I can say I worked on one of the largest directories in the world... over 52 million user objects and hundreds of millions of objects.
AD does not scale well. Senior Mgmt wanted to move from eDirectory to AD due to some price breaks on desktop os and MSOffice for over 50000 employees... so we made the attempt with Microsoft in house providing consulting services... they eventually admitted even they couldn't get it stable in our large distributed environent... during the one year migration troubleshooting process we had contractors restarting servers in hundreds of locations around the clock.
We're now back on Novell eDirectory with Open Enterprise Server and stable again.
------------------------------
Ray Raspberry
raspberry@b3l33t.org
Open directory is (as I understand it) basically openLDAP with a config file and a nice GUI.
Open Directory covers a lot more than LDAP. Yes, it's based on OpenLDAP -- in part. Yes, there is a nice GUI, which you can use to administer users and groups remotely, from another Mac OS X machine.
But there's also MIT Kerberos, integrated with the LDAP. When you create a user in Open Directory, the necessary Kerberos principals are created for that user. User identification (linking usernames with Kerberos principals and home directories) happens automatically.
But wait, there's more -- there's also the Apple Password Server, which is based on the SASL layer from CMU. This provides centralized, non-Kerberos password support, for things like CRAM-MD5 authentication, or NTLMv2 auth for Samba. The Password Server passwords are automaticaly synchronized with the Kerberos passwords. When you change a user password in the KDC the corresponding password is also changed in the Password Server or vice versa.
Still not happy? How about built-in replication support for load-balancing and high availablility. It covers not only the LDAP database via slurpd but also the Kerberos and Password Server databases?
Oh, and one more thing -- encrypted archiving built in to the GUI. Archive your entire set of LDAP user information and your password database to an encrypted disk image. Secure and convenient.
(Yes, I work for Apple -- but the parent post misses most of the good parts.)
--Paul
Cheap - $1K for an unlimited server license, and the Xserves come with the license and are great performers in their own right and cost-effective.
It has ease of use GUI goodness, with a full open source stack underneath: supports Open/LDAP directory services, single sign-on, kerberros, email, calendering (via WebDav), file services (via Samba for Windows and Linux), CUPS, Apache, DNS, Mailman - the list goes on and on. It plays extremely well in mixed environments and is extremely easy to administer - no steep learning curve.
It's far cheaper than all the other alternatives, including Novell and RH, not to speak of Microsoft. And soon you will be migrating all your users to OS X boxen as well once you see all the advantages.
I have done administration on all the other alternatives and I'm far from an Apple fanboy, so don't start flaming me on that score.
As far as I recall, the Apple Password Server is only provided for backward compatibility with previous MacOS releases. I don't wish to denigrate what Apple has achieved in shipping OpenDirectory with their OS, but anybody can install Heimdal Kerberos, OpenLDAP, and Cyrus SASL and get automatic integration of Kerberos principals with LDAP accounts and Cyrus passwords. All of these three packages support each other directly, out of the box. And likewise, since you can create a single LDAP user object with all of their Kerberos info, Unix info, and SASL info in one place, they naturally all replicate together. So there's nothing magic about OpenDirectory here. (Nevertheless, OpenDirectory is good stuff, and I'm sure it will be even better in the future.)
And yes, I'm on the OpenLDAP core team, and I wrote a lot of the code that makes Heimdal, OpenLDAP, and Cyrus SASL play together. It's been working well in the field for years. And for those people who have trouble getting configure scripts to connect everything the way they want, my company Symas Corp. offers pre-built binaries of all of these packages, already integrated, ready to run.
-- *My* journal is more interesting than *yours*...
Along with Zenworks (an eDirectory enabled management application) you can have your group policies too! Buy Netware (or Open Enterprise Server - Suse SLES 9.0 + Novell services by another name) and you'll get all of the eDirectory and Linux goodness, plus DirXML which is a programmable metadirectory allowing synchronisation between eDirectory and whatever you want (including MS-AD)