Searching for a Directory Service Solution?

kumulan wonders: "I've got the responsibility to set up directory services as well as a messaging/groupware system for my organization of app. 100 employees spread out over three locations. We are a startup that is merging three existing smaller companies and, given the state of existing IS infrastructure at each of these locations, the decision has already been made that we are better off starting from scratch. It would be great to hear from Slashdot readers concerning which option is 'better' and why." "For me, the choices are stark and clear:

1. MS Exchange/Active Directory
2. A cobbled-together solution based as much as possible on OSS (as no direct equivalent exists).

For (2) we have evaluated, and are strongly considering, the following:

• Samba/OpenLDAP/Kerberos
• Bynari Insight Server for messaging/groupware.
• Nitrobit Group Policy for, you guessed it, group policy management.

Of course, Samba 4 will address some of this 'cobbling', but we can't wait for that."

Comments

Easy.

[XorNand]

So, the question seems to be: OSS vs. Microsoft. Am I right? If so, the answer is easy: Which platform are the people who will be managaging the stuff have the most experience with? It may be sacrilege to say it here, but if you've a crew of MCSEs on staff who've never touched Linux, it's going to be more expensive and a bigger hastle go the OSS route.

I forget who said it but "OSS is free like a puppy is free". You need to have the staff to tend to the care and feeding. In the Detroit area at least, Windows guys are a dime a dozen. Competent Windows guys, while a bit more rare, are still easier to find than experienced Linux admins. (Of course, I'm looking at your question from a business consulting standpoint. If you're looking more for a technical recommendation, there's a lot more people here better qualified than me.)

Re:Easy.

[ndansmith]

You may be underestimating just how much is actually costs to get a Microsoft enterprise solution off the ground. You have to pay for the Server 2003 software, Exchange, XP Pro (volume), Office, Terminal Services licenses, and don't forget server CALs. Plus, you have to worry about Microsoft "obsoleting" your software via Vista, Longhorn Server, Blackcomb, and beyond; another round of licensing (and by extension of Vista's hardware requirements: another round of hardware updates / replacements).

Sure, it may require a fine tooth comb and/or training to get some qualified Linux guys on board, but I doubt that compares with the expense of purchasing the Microsoft solution.

Re:Easy.

[zulux]

if you've a crew of MCSEs on staff who've never touched Linux, it's going to be more expensive and a bigger hastle go the OSS route.

MS's newest/latest/greatest has a large learning curve as well. You old MCSE who knows Windows Domains will have just as much trouble learning Active Directory as he would have learning Samba 3.

I've trained MCSEs in open source technology - about 50% do just fine. The otheres were paper MCSEs and sucked at Windows too.

Re:Easy.

[Daengbo]

While I agree with you, the K12OS mailing list that I continually lurk on has quite a few inexperienced Linux fols, and the single sign-on issue has basically been solved by one of them. David Trask has put together a script which automates setting up smb-ldap for a PDC, and it's here: http://web.vcs.u52.k12.me.us/linux/smbldap/

As for a groupware solution, I currently use egroupware ( http://egroupware.org/ ), which is fairly mature, can authenticate to ldap, and can be used both over the web and thorugh Kontact as a client.

Re:Easy.

[XorNand]

Not really--I myself and am MCSE and run my own consulting company where the majority of my clients run Active Directory. I'm quite aware of the costs. MS includes a license for Outlook when you buy a CAL for Exchange, so that extra expense is negated. OpenOffice also might make a viable office suite for this person, but the question was about directory services. Terminal Services is a non-issue in the same regard.

And it's not as cheap and easy to get quality techies as you might think. Putting your existing staff through a boot camp is only the tip of the iceberg expense-wise, and it's a very inefficent solution.

Re:Easy.

[killjoe]

Just be sure to include your long term costs when you are evaluating. you should calculate the costs of integration and upgrades too. MS products don't work well with other companies products and will inevitably cost you hundreds of man hours if you are ever presented with the problem of integrating non standard MS software with software from other vendors.

As far as admins go studies have shown that unix admins on average maintain more servers per admin then windows admins. You may be able to do with one unix admin as opposed to two windows admins.

windows machines as a rule run less services per machine then unix machines do. This means more servers, which means, more servers to patch, keep up to date, backup, and admin.

Finally the perenial problem of backups and bare metal recovery. This is trivial in unix but costs thousands if not tens of thousands of dollars for windows.

There is a lot to think about. Just saying I have used windows XP before so i can maintain a active directory/exchange environment is plain old stupid.

Re:Easy.

[hagrin]

MS's newest/latest/greatest has a large learning curve as well. You old MCSE who knows Windows Domains will have just as much trouble learning Active Directory as he would have learning Samba 3.

I've trained MCSEs in open source technology - about 50% do just fine. The otheres were paper MCSEs and sucked at Windows too.

Ok, so you're saying techies trying the latest and greatest without any training fail more often than the users who received your training in OSS solutions? So, obviously, the parent still remains correct - whatever you are trained better in should be the solution that is adopted. Otherwise, the cost savings you get from OSS may never be reaped as their company experiences downtime, frustration, inexperience and getting the proper training they need.

I think it's fairly clear that with the proper training and proven, qualified individuals that any solution will work if properly implemented and maintained.

Re:Easy.

[TedCheshireAcad]

Parent has a valid point, setting up and administering your OSS solution will take more work. However, you can tailor it better to your needs.

I worked at Major Software Company in the Bay Area (tm), and their LDAP/Kerberos/Jabber/SMTP infrastructure worked very well, but of course, there were armies of admins to make things run smoothly. It was not without hiccups - but most if not all of the hiccups were minor (failed hard drives, etc.) and remedied within 20 minutes.

My vote is for LDAP. You can do so much with it - authenticating users on your web apps is a cinch, directory lookups are easy, it integrates with every piece of mail client software, and it's free. Just my $.02.

Re:Easy.

[sillypixie]

I think you are missing more than a few options there.

IBM has directory services.

Sun has directory services.

Novell has directory services.

My thoughts:

- the problem with IBM's directory is that it sits on top of DB2. This abrogates one of the coolest parts about directories - that you don't need a DBA. And a mistuned IBM directory is an ugly, ugly thing.

- the Sun/Netscape/iPlanet/SJSDS-whatever-they-call-it-t his-second tends to run well directly out-of-the-box without the need for much in the way of expertise, in smaller environments. I would call this directory the defacto standard (although this statement may now be obsoleted by the advance of AD - hard to say). If you are using other SUN infrastructure, or if you are using the Sun Calendaring/Messaging product (which I would recommend as a very solid alternative to MS exchange), this DS is an excellent choice.

- Novell - well if you are a Novell shop, you will use NDS. You will use everything else Novell has. It is sort of like joining a secret cult.

- OSS - I would consider this an advanced option. My suggestion is, if you know nothing about directory services, that you would be better off with something a little more... packaged. I'm sure many here will rabidly disagree with me, but I certainly would consider that choice as risky. A second issue is that many LDAP-enabled products that you may wish to run on top of your directory layer (provisioning, WSSO, etc) only support commercial directory servers.

- Microsoft - well, you're probably going to have to install this one anyways, in order to get a LAN. Although I'm a unix chick at heart, I must admit that I have seen many well-run AD directories. If you aren't already in the UNIX world for any good reason, AD is probably a logical direction. Many many companies have cut their directory services teeth this way. The disadvantage is that your Enterprise Directory is also your NOS, which can be a pain from a licensing perspective, if you want to store authentication-only users as well.

FWIW, hope that helps...

Re:Easy.

[Tadrith]

This is definitely true. I've found it much easier, if instead of thinking of people as Windows techs, or Linux techs, you simply think of them as techs.

A good tech should not be afraid of discovering and learning any system he or she might put their hands on, because part of being a good tech is learning how to keep your mind open and troubleshoot a problem. It doesn't matter if the problem is Windows, Linux, or a coffee maker -- you use the tools that you have to do the best job you can.

I am a programmer for a living, but I also do double time as a technician. I am just as comfortable configuring Windows Server 2003 as I am with Novell Netware 6.5, or any flavor of Linux. I don't see it as my job, or my passion, to devote myself to one platform. My job is to help people with computers and give them advice on what solution works best for them. Of course, I have a primary area of expertise, but that doesn't stop me from learning on my own.

Re:Easy.

[Total_Wimp]

A good tech should not be afraid of discovering and learning any system he or she might put their hands on, because part of being a good tech is learning how to keep your mind open and troubleshoot a problem. It doesn't matter if the problem is Windows, Linux, or a coffee maker -- you use the tools that you have to do the best job you can.

This is probably true for new guys learning an in-place system or a few new systems added to the familiar core network, but far less true for a bunch of newbies (to the system in question) trying to design something good from scratch.

A good ADS guy will know how to design a good forest, he'll know how to acquire and install the necssary patches, he'll know how to set up a secure systems and he'll know the quality sources of help when he needs them. He'll know which built-in and third party utilities will save his bacon and he'll know what to check on if stuff stops working.

The only thing that will teach an MS guy how to do all this with Open Source is experience. The only way he'll get that is with a bunch of time working with the products in question.

In other words, it's dangerous as hell to trust your brand new network with a bunch of noobs. Even if they're very bright noobs who will catch on quickly, you take quite a risk while they're doing the catching on. Put a bunch of these guys under a couple of experienced people and they'll likely do ok with the new network, but if you don't have that experience on hand you're begging for trouble if you uproot a known system and throw a bunch of new stuff in to replace it.

TW

En abyme

[timeToy]

There is no directory service for directories services ?

3. Mac OS X Server

[dgatwood]

Considered Open Directory?

Other options?

[MonoNexo]

What ever happened to Novell? I used that at the college I attended - web apps, email, directory, rempote access, etc. Is this no longer a valid option, or was it just forgotten on the above list?

Re:Other options?

[killjoe]

It's all still there, it's still viable, it's still better then what MS offers, it's still cheaper then MS.

Just because something doesn't get a lot of press doesn't mean it's gone.

Re:You want to save money?

[Mr. Underbridge]

Christ on a motorcycle, it doesn't matter what machine he runs, that doesn't solve his problem. Goddamn, at least keep the evangelism moderately relevant.

Look at OpenExchange

[adturner]

It's a standards based (LDAP) mail/groupware app which supports standard SMTP/IMAP clients as well as Outlook/Palm clients (for an additional fee).

Seems competitively priced to Exchange and there's also a free pure OSS version available (although if you want offical support and a nice installer, you need to pay for it).

http://www.openexchange.com/

I haven't personally used it, but I've been looking at it as an Exchange alternative (I really really hate exchange) for the small company where I work.

Re:Look at OpenExchange

[jbellows_20]

Why hate Exchange? I've managed Exchange 2000 and 2003 for 5 years and I have loved working with it. Simple to setup and manage and loads of features. I've looked for a truly comprable OSS option and haven't found one that does nearly as much with the same ease.

STOP....

[ellem]

just save yourself the trouble

W2K3.

Just shut up, buy it and be done with it. It'll hook up with whatever you're running and it is fine as long as you take the same precautions any decent Sys Admin would.

Re:STOP....

[j-cloth]

You have to use the right tool for the job. In this case there is no directory server that can touch AD. Any other solution is just trying to replicate it.
Exchange, I'm no so sold on, but it works and is well documented enough that you can do most of things with it that you will want.

Re:STOP....

[aaronl]

Novell with NDS does all that AD does, and a lot more. It is an incredibly well designed directory server, and it existed before AD. The big reason to go with AD is because of group policy; I don't know if NDS has an equivalent to it.

It might still be that W2k3 is the right tool, but please, have your information straight!

Re:STOP....

[divisivemind]

Though I've never laid eyes on an OSS directory alternative to W2K3, I'd be surprised if it could be any either to use out of the 'box'. Another thing, if you plan to do some LDAP work, in say perl, modules exist that can add/remove/delete/etc from your AD that are rather painless to use. Automated account addition.... On a side note, for those in higher education, there is a good chance you have a campus-wide MSAD. Where I used to work, we kicked all students out of our domain and instead one way trusted their campus MSAD accounts. Imagine not having to deal with user accounts again =) This still allows you to moderate access to your domain machines (assuming you have the proper OUs set up) and retain administratiive (both local and domain) control over your machines. We chose to leave faculty/staff on the old domain for the ease of not changing the entrenched. This was actually a pretty seemless transition. Students still have access to their home directories on the local domain (ala perl automation) and FTP/Terminal Server access. FWIW have fun.

Re:STOP....

[AmigaBen]

It's eDirectory these days, rather than NDS. And as for group policies and so much more, see ZENWorks.

Re:STOP....

[AngryElmo]

Along with Zenworks (an eDirectory enabled management application) you can have your group policies too! Buy Netware (or Open Enterprise Server - Suse SLES 9.0 + Novell services by another name) and you'll get all of the eDirectory and Linux goodness, plus DirXML which is a programmable metadirectory allowing synchronisation between eDirectory and whatever you want (including MS-AD)

There are Other Options

[Anonymous Coward]

Other Options to Consider:

Novell:
Linux Small Business Suite
http://www.novell.com/products/linuxsmallbiz/
It includes edirectory, groupwise for email, suse enterprise server,Novell ZENworks Linux Management Client

IBM (Lotus)
http://www.lotus.com/lotus/general.nsf/wdocs/nd7co ntent
You can use Domino as an ldap server.
Other IBM Software on Linux:
http://www-306.ibm.com/software/os/linux/software/
or
http://www-1.ibm.com/linux/matrix/

Novell NDS

[kalibyrn]

There's also Novell's NDS... That could be your third option perhaps...

Another Consideration

[joelleo]

What exactly is the newly merged company doing? Is it supposed to be geeky-cool? Is it doing something totally unrelated to computers or technology? Is the IT infrastructure just a means to an end - users getting their work done?

If the company is trying to do something geeky-cool, you may be best served by using a "cobbled-together" open source architecture. It'll show your boy's and girl's prowess on the console and could be used as a Hercules-on-a-pedestal showcase for your talents.

On the other hand, in either of the other two cases, you're most likely going to be using MS on the desktop and your people aren't going to care that you've implemented OpenLDAP as long as their Word, Excel and Outlook work. In this situation, as has already been noted, you'd probably be best served by implementing Windows Server 2003 + Active Directory. An additional benefit is the expertise is relatively cheap and available, and may already be in-house with your amalgamated IT staff.

Good luck!

Re:Another Consideration

[benjamindees]

may already be in-house with your amalgamated IT staff.

Or there very likely isn't an IT staff, almagamated or not. Three companies that join to form 100 employees, with poor infrastructure, typically means one company of 50 employees and a "Windows admin/something else" and two companies of 25 employees each that paid somebody to setup their networks five years ago and have since just watched it deteriorate.

It sounds like the inquisitor is about to inhereit a huge mess without necessarily the skills or resources to deal with it. If that's the case, I'd suggest taking a long-term approach:

1) Decide who will manage the network (this is a full time job),
    A) if it's you, then
          i) choose what you're most comfortable with, else
    B) if it's not you, then
          i) put an ad in the employment section, outlining your requirements in a non-specific way, contact outsourcing firms, and take applications.

You may be suprised at what you get. Linux and Open Source can save a ton of money and hassle long term, especially when implemented from scratch, but you have to know what you're doing. If you don't know or aren't sure, get help. A company of 100 employees can easily justify having two admins, especially when combined with the savings Linux and OSS are capable of.

Re:Another Consideration

[Penguinshit]

Cost is definitely a major factor here.

While going the W2K3 route would be easy and very functional, one has to take into account the cost of the eventual [forced] upgrades. A company of 100 folks probably isn't turning a wild profit in terms of real money, and what money there is will undoubtedly get funneled into R&D or advertising or SomethingOtherThanITInfrastructure. This is where the long-term cost savings on a "cobbled" solution will pay off handsomely.

The decision is best made right now.

Re:Another Consideration

[Penguinshit]

Troll?

I dare that coward asshat who modded me troll to come out from under his/her rock and prove the honesty of that mod.

I guess that person never heard of the "Software Assurance" program from Microsoft that forces upgrades every two years (with the alternative being a highly-inflated upgrade price whenever one is eventually required to upgrade). Everything else I said comes directly from my decades of personal experience in administering Microsoft and Unix/Linux (as well as Mac) networks.

I've got karma to burn. But leave your bullshit agendas out of the moderation (that goes both ways).

Re:Another Consideration

[SparklingClearWit]

You may be suprised at what you get. Linux and Open Source can save a ton of money and hassle long term, especially when implemented from scratch, but you have to know what you're doing. If you don't know or aren't sure, get help. A company of 100 employees can easily justify having two admins, especially when combined with the savings Linux and OSS are capable of.

Y'know, I keep seeing this argument on Slashdot, and it's always with the caveat "almost as good" or "the savings that Linux provides".

I've yet to see somebody come up with a real cost savings - a TCO study - for a small business using a "cobbled together" Linux/OSS solution compared to a Windows-centric solution.

Firstly: The admins. Linux admins aren't plentiful. They might appear so here, but just because you've installed Gentoo, you're not a real admin. Your users and business owners will dictate to YOU how things will be. You can have influence, and you may steer things, but being a zealot doesn't pay the bills.

Let's say they hire you, and you implement OpenLDAP, perhaps Linux for Terminal Services on the desktops (you smart guy, you), and a snazzy Windows-like distro for the execs and upper dudes in your 100-seat organization. You've got the desktops all set up great, etc., and new machines go on the network with no problem.

Now, the company is acquiring another firm - and they use (Oh Noes!) Windows! (oops, sorry - M$ Windoze - did I do it right?) They've got a KillerApp(TM) that your suits decide they Must Have and Use Daily as it will Multiply Productivity!

So you test. Oops, no OSS equivalent. Damn. Ooops, doesn't work in Crossover Office. Or Wine. Damn again. The company has no plans for an OSS release. Damn again. So ... you can install a couple Windows machines to satisfy the execs, right? Ooops, then they push it company-wide. Oh, sorry boss - you've gotta pony up for 100 seats of Windows XP Professional so we can run this app.

Second scenario: After this horrible mess, you decide to leave for purer, greener OSS pastures. what does the company do? Did you document all your work? Does *anybody* know what you've done? After all, you can't just 'pick up' Linux - it's not easy, like dumb old Windows! So how does the company hire to replace your knowledge? Oh, they can't? You're indespensible now?

These thoughts are what percolate through the minds of business owners. They're not uninformed about Linux. They've heard all the zealotry and pitfalls, and the risk to their business is NOT worth it. The cost of upkeep, finding workarounds to compatibility with their partners, vendors and customers, and the inability to just 'buy a program' is the hamstring for mainstream business adoption.

Re:Another Consideration

[ocbwilg]

I guess that person never heard of the "Software Assurance" program from Microsoft that forces upgrades every two years

Software Assurance is not mandatory. There are quite a few companies (probably the majority) who don't use SA. Mine doesn't. Upgrades are still cheaper than buying new, but most companies aren't all that keen on constantly upgrading, and the ones that are will go with SA. Most companies buy new hardware, and buy it with and OS and applications they will need. The hardware runs and does it's job for 3-5 years, and when it's ready to be replaced the next version of the OS and applications are purchased.

I dare that coward asshat who modded me troll to come out from under his/her rock and prove the honesty of that mod.

You can't mod and post in the same topic. But assuming that the coward asshat did come out under their rock what would you do? Kick their ass? Grow up. Bad moderation is usually corrected by othe mods and is somewhat lessened by metamoderation. Get over it.

Fedora Directory Server

[LnxAddct]

Use Fedora Directory Server or Red Hat Directory server. It is derived from the acclaimed Netscape Directory Server. It is easy to set up, scalable and *just works*. For groupware just use phpGroupware or something. If all you need is mail access, I recommend Roundcube for the web access, it uses Ajax to give a nice user experience akin to Yahoo or Gmail. Keep an eye on the Hula Project too, it looks like when a release it made it will be real nice.
Regards,
Steve

NDS

[discordja]

I'm sure some /.ers can give you a better view of the quality of Netscape Directory Server but from the rumblings I've heard it's a complete package and it's pretty damned amazing (not to mention it supposedly scales through the roof).

You can check out the documents here

Novell

[Anonymous Coward]

I don't know what your selection criteria are, but it seems to me that you have another choice: Novell's products. More specifically:
1. Directory Services: eDirectory. It runs on multiple OS platforms such as Windows, Linux, NetWare, Solaris, etc. It is more robust than AD, particularily across wan links (viz. replication). And of course it is LDAP v3 compliant so nearly any LDAP client can use it for authentication and authorization.

2. Open Enterprise Server, Linux and NetWare. For hosting your file and print services. You get the best file system out there - NSS - on either platform. Real ACL's and vastly more refined trustee assignment and inherited rights filtering capabilities than any other filesystem.

3. Groupware/Messaging: I am less experienced in the alternative offerings in this catagory, but I believe that Novell has a decent product in GroupWise 7, which runs on Windows or Linux or NetWare.

Again I don't know what your selection criteria are, but you may have skipped Novell due to lack of awareness...

Cheers.

XAD

[lukehatpadl]

Try XAD from PADL.

To Windows clients, it acts as an Active Directory domain controller, so it supports Kerberos authentication, group policies, etc. It also includes RFC 2307 support for seamless integration of Linux/UNIX clients.

That's what I thought.

[lsommerer]

That's what I thought when I read the requirements. Netware (or whatever they are calling it now that it runs on Linux) and Groupwise should be all you need.

I don't know about cost. We have their educational license, and that includes Netware and 3 other products (we use Groupwise, ZENworks and iFolder) for less than $3.50 per student. The license covers as many servers as we care to run those products on.

Try Solaris

[tonyr60]

Download Solaris for free. It includes LDAP plus Samba etc. Includes fairly easy admin tools (for example webmin) The LDAP is first class and integrated fully with the OS and Samba. You can do it all and nothing is "cobbled together".

cobbled-together?

[AstroDrabb]

2. A cobbled-together solution based as much as possible on OSS (as no direct equivalent exists).

Well, it sounds like you are an MS-Only type guy with limited experience outside of the proprietary MS-World. There are some excellent solutions that run under Linux. Have you looked at Novell GroupWise?

Novell GroupWise is a complete collaboration software solution that provides information workers with e-mail, calendaring, instant messaging, task management, and contact and document management functions. The leading alternative to Microsoft Exchange, GroupWise has long been praised by customers and industry watchers for its security and reliability

GroupWise is cross platform, unlike MS Exchange/AD. GroupWise has plenty of free tools to help you along the way like:

• GroupWise Migration Utility 2.0.1 for Microsoft Exchange
• GroupWise PDA Connect 1.0 SP1 Multi Lingual
• GroupWise Import Utility 2.0 for Microsoft Outlook
• GroupWise Gateway 2.0 for Async Connections
• GroupWise Gateway 3.0 for Lotus Notes

Just check out Novell to see some of their products (no, I do not work for Novell, I just like some of their products).

Also, there are some really great LDAP/IMAP type solutions you can put together under Linux for zero cost. Obviously this option requires someone more capable than your typical point-n-click "MS-Admin". It would take one employee with the ability to read a book or some docs. Though, I know your typical point-n-click "MS-Admin" wants to be able to just put in a CD and let AUTO-RUN do all the "hard" work for them.

If I personally owned a small company with ~100 employees, I would rather have one talented admin that could handle *nix/Win than 2-3 point-n-click MS "admins". If you added up the salaries, that one guy would cost you less than the 2-3 less capable point-n-click MS "admins". TIJMO (This is just my opinion).

Re:cobbled-together?

[ThisOrThat]

That's odd. We use Novell for all user storage/printing/groupwise/etc for thousands of PCs and have none of the issues you list.

Which version of NetWare are you on?

The college is went to a number of years ago used NetWare (and still do) and it works very well for them.

At work we have edir and AD integrated, edir being the main directory. I mostly work with HPUX/AIX/Linux but have done a little NetWare stuff in the past. I don't know about current QA at Novell but we don't seem to have many issues that I can tell. GW use to be pretty bad a few years ago but they have since upgraded and it's been working like a charm.

When I have had to do administration of MS servers (doing contract work or what not) I realize how much better the admin tools are in NetWare vs MS. Unless it's changed (and I don't think it has) assigning/administrating file rights and users is a pain for any sort of large network. Also login scripting in MS bites really really bad IMHO. I can't believe that MS can't have a better way of doing login scripts.

Oh well,

- Justin

Re:cobbled-together?

[DaveV1.0]

How many companies out there are sole proprieterships? What about LLCs, where one of the people happens to have/bring in about 80% of the billables.

This is exactly why so many small businesses fail. A sole proprietorship (SP) where the owner is in an accident or gets sick and can't work or an SP with an owner who can't do it all. Great tech but a crappy marketeer, or good salesman but lousy time management or poor quality work. An LLC where one person brings in 80%, and then that person leaves, gets sick, dies, etc. is pretty much doomed to fail. I have seen it happen.

Just about every "owner" or "CEO" fits the "business revolves around one person". Apple now w/o SteveJ? Yeah.

While a small business with consolidated power will revolve around the one or few people with the power, one being the CEO does not mean the business revolves around one. That is the kind of thinking that led to the dot.com bust, Enron, and all the other scandals. It is also the kind of thinking that has caused CxO pay to balloon, while the middle and lower employee's pay has barely increased (it hasn't even kept up with inflation). If what you say is true, then no CEO would ever be unseated because it would be death for the company.

Fedora Directory Server?

[graphicartist82]

I've just started to take a look at Fedora Directory Server. It is very easy to set up and with the GUI manager, it seems about as easy to manage as Microsoft AD.

Why, again?

[Dunkirk]

Why are those your "stark and clear" choices? I know, for example, that there are solutions from Novell, SuSE, and Sun, without even thinking about it. Are there more factors involved here than just "we need a directory?" Given a clean sheet of paper, I'd be using eDirectory, since it's completely (according to the marketing papers -- I've never used it) cross-platform.

Re:3. Mac OS X Server

[Penis_Envy]

The questioner did mention openldap. The advantage of going to the apple solution would be the integration that it would provide, rather than "cobbling" together the solution themselves (as they said themself.) It's not just the GUI. Then again, it would be one more thing to manage/maintain.

Bynari / Samba - Win-win scenario

[Kris2k]

I do some implementation projects for an IBM reseller who does implementations on the iSeries platform, and they push (and I implement as the consultant, go figure) a lot Samba + Bynari to the point that I was actually convinced myself and bought myself a few lics for Bynari.

The nice part about Bynari is that they have great support, and they are continueously improving their product, and they use open technologies (OpenLDAP/Cyrus/Postfix) so its easily hackable. The Outlook IMAP connector rocks, and so far, I think is the only viable product out there if you're on a trim budget.

I haven't tried it yet, but having Bynari and Samba share the same LDAP schema seems to be my next personal project. Maybe even lobby the concept to them ;)

Novell

[RabidMonkey]

Theres always EDirectory ... it runs on sles9 now (as of version 7). All the joy of NDS, but it runs under Linux (and windows, and netware if you want).

I'm going to a Zenworks 7 thingy on Wednesday .. if you want more information about running edirectory under linux, email me and i'll pass along what I find out.

it's not just about OSS and Windows .. there are other products there. NDS is far superior to AD, so consider it as well.

Do you have Windows desktops ?

[drsmithy]

If you do, AD is your only realistic choice. Group Policy alone justifies using it.

Added to that, it's not especially difficult getting Unix machines to talk to AD for authentication and other information (it's just LDAP, after all).

It's a hell of a lot easier to integrate and manage a handful of unix machines in a Windows environment than it is to integrate and manage a hundred Windows desktops in a unix environment. IME, that's typically the scenario (unix servers for mail, fileserving, DB, etc and Windows desktops).

Mod parent hilarious

[Anonymous Coward]

W2K3 ... is fine as long as you take the same precautions any decent Sys Admin would.

Myself being a decent Sysadmin, I can tell you my first priority is always to banish MS products to the extent possible. It takes time, but if you're starting from scratch this is an excellent opportunity to avoid future problems.

Start by NEVER running anything mission critical under MS - especially a directory service.

Continue by banning Internet Explorer companywide, and finish by

Don't get me wrong; MS Windoze does have its strong spots. It is superb for playing games, hosting virus servers, spam drones, and spyware. If you want East European crime gangs to install packet sniffers, keystroke loggers, and Trojan Horses on your network, there is no platform more ideal than Microsoft Windows. But of course these strengths have nothing to do with running a secure business.

Since you probably will have to run MS Office, do a trial run of MS Office under Mac OS X. You'll be quite impressed: You can have MS Office without all the client problems! Who would have believed such a thing could be possible? You may even find that OpenOffice is far more than sufficient.

Deploy OpenOffice far & wide, but keep a couple spare seats of MS Office (for the Mac) onhand "just in case" some executive starts whining about different software, so you can just install it here or there selectively and shut them up. (That's the main purpose for buying MS Office. To shut people up.)

The executives may question issuing Powerbooks for the traveling employees, but they WILL NOT complain when you show them the respective overhead and MIS support estimate numbers and corporate security differences when viruses and so on are all taken into acount. Your company will remain freer of viruses when those traveling notebooks get plugged into the internet at hotels, then subsequently carried back to the office and plugged in again. Windows notebooks are one of the most notorious and uncontrollable computer virus vectors for spyware/crimeware.

Novell's/Suse's SLES 9

[mgpeter]

Suse Linux Enterprise Linux 9 should have everything you need. It sets up and stores just about everything in LDAP. It is extremely easy to configure and maintain. Yast's Email Server module will setup Postfix/Cyrus/IMAP for you, hell it even installs Antivirus and Spam filters for you.

If you need to control Windows Clients simply create custom Policies for Microsoft's System Policy Editor (or use mine at my web site).

I have currently replaced 5 Windows Servers with SLES9 and have not had a single problem. IMO it is much easier to maintain/use than anything MS has released in the server department.

Active Directory and Exchange

[mrscott]

Before I write, I should say that I'm in no way opposed to open source and use it where appropriate.

If you want something very well supported, not horribly difficult to administer in a simple environment and tried and true, just go with Active Directory and Exchange, especially if your company's focus is on something other than providing unique technology solutions. (i.e. you sell baskets)

While the open source solution might cost less up front, there is nothing in open sourece land at present that can touch the Exchange/Outlook combination. Sure, there are products such as OpenExchange, but, let's assume that you want the option to easily add other services later on, such as true handheld synchronization (i.e. www.good.com)

I know it can be sacrilege on Slashdot to not promote an open source solution every time, but sometimes, the business side of the house is more important than a cool technology solution.

Re:I know! I know!

[mabhatter654]

The whole point is that he wants to learn to be the expert! If everybody on slashdot knows so much why is this such a difficult question? This is where the rubber-meets-the-road folks... if you want to use Linux and OSS professionally these are the questions that need answered by the community.

Novell?

[sjs132]

What, Just rule them out? They've been doing Active directory and groupware LONG before Microsoft decided to emulate (steal) the ideal...

Novell 6.5 is the latest, and I can lock out users based on windows policies, etc.. just like MS active dir... assign various sub admins to rule over their own dept, etc... AND Groupwise (IMHO) is a great email/calender app... (Groupwise 7 is supposed to be better, but I haven't gotten to play with it yet...)

AND they are starting to move everything over to Linux via SUSE Linux, so you have the OSS...
Best of both worlds if you ask me...

Sure, Novell AND Microsoft cost $$$, you could build your own Linux server and hack it together, but if your a REAL company and you expect to play REAL Ball, you will PAY to have the propriatory software to compete with everyone else... At least with Novell, you can still play OSS and support linux, etc... even if you have to buy their version...

OSS Does not equal FREE... Thats the problem... too many freeloaders want EVERYTHING for FREE... If that was the case then your company would just give its product away also... oops, now your company is dead... Guess that model won't work.

I must admit, I do ADMIN a Novell network, and I do like SUSE Linux... Much better than anything MS has to offer...

Again, just my .02 worth... (climbing into Flame resistant suite)

What's missing from Apple

[DorkFest]

We implemented Apple Open Directory, serving ~400 users, using four Xserves and and two Xserve RAID's. We're using Apple's mail services, file, web, web log, and VPN service.

So far, things have gone better than I expected. We are authenticating Mac, Windows and Linux PC's, all of which can access the same home directory. The Open Directory master server also acts as the Windows PDC and serves up roaming profiles for Win XP clients.

What I've been hounding my Apple rep about is the lack of a real group callaboration suite. The pieces are there; iCal, Address Book, Jabber, Cyrus/Postfix. They need to be brought together in an Exchange/GroupWise sort of fashion. We are still using Steltor Corporate Time (now Oracle Collaboration Suite) for calendaring, task lists, and shared contact lists. I'm watching the Hula project closely. Rumor has it Apple is shopping around for a comprehensive group collaboration system. Hula might be it! Zee dork

Maybe not so easy.

[jd]

Let us say that you build a direct equiv. in Linux. "Impossible!" I hear you cry! Well, maybe not. Not unless you've cracked into my machine and installed an MP3 of yourself.

Anyways, let us examine the different components and see how far OSS can take us. Maybe it can't go the whole journey, but if it can do some, then a hybrid solution will work.

Open Groupware, SuSE's Open Exchange and OSER will handle the Exchange part, including support for all those MS Exchange clients, such as Outlook.

That just leaves the Active Directories part. ISC's DHCP supports Dynamic DNS. However, you may want to add in DHCP2LDAP to get a good link between DHCP and BIND. OpenLDAP provides the LDAP implementation part. Kerberos and DNS are easy (although some may quibble with my choice of Kerberos version!)

Provided you're not planning on having both MS Active Directory and the above amalgam running, you should then be set to go with a comprehensive Active Directory lookalike which will interact with client systems in the same way Microsoft's software will.

The problem I found is that there's almost no way of getting from a Linux solution -to- Active Directory. If AD is present, it must be a root server, which Linux CAN pull from.

Do I recommend this kind of a setup? Probably not. The Exchange and Groupware stuff should be fine, but the Active Directory stuff isn't as coherent as it could be and I've heard of nobody who has completely replace AD with an Open Source solution, even though from a purely technical perspective it should be possible.

Re:Maybe not so easy.

[Korgan]

May I introduce you to an opensource Directory solution that quite nicely replaces Windows Active Directory. Many moons ago it started life as just OpenLDAP but it is now become so much more.

http://www.apple.com/server/macosx/features/opendi rectory.html

Good ol' Apple.

Darwin, *BSD, Linux, various Unixes. Builds with GCC and source is available under Apple's OpenSource license.

Redhat's RHDS available on subscription for RHEL3 and RHEL4 is another. Based on Netscape Directory Services. Thats mostly available under the GPL now, called Fedora Directory Server.

http://directory.fedora.redhat.com/

Personally my favourite has been eDirectory. It may not be opensource or even free, but the little you do pay for it is definitely worth the product. Anyone skipping over it is either deliberately obtuse or just plain ignorant. Especially if they're willing to pay for Active Directory and all the costs that go with it (including licensing, security and maintence/administration) while receiving a far inferior product.

Ultimately, Ask Slashdot is the worst place for the original poster to ask this kind of question. They need to sit down with people from various companies and vendors to get an idea of all available products. Many will happily discuss the requirements and work together with you to find the best solution, not just sell you a solution from a preferred supplier.

Ask various engineering places in the district to submitt RFP's based on requirements you set. It doesn't have to be a multi-million dollar contract to get many interested. Companies are starting to really take notice of the SME market now days. Ultimately the have to. ;-)

Anything but Novell

[sameat]

I'm afraid I can't help answer the initial question, but I have to caution you strongly regarding all of the suggestions for Novell products.

I live the Novell dream everyday, and "cobbled together" would be a generous description of their products and services. This is a company with a time honored tradition of rendering promising technologies useless. They handed most of the market to MS on a silver platter.

Before you consider Novell too seriously, look through the forums at forums.novell.com, be sure ask about your support options , and try to get a feel for the staffing and training required for a network of your size and scope.

Stick with your inital instincts, just remeber that very few Novell products are actually Open Source.

Re:3. Mac OS X Server

[macshome]

Open directory is (as I understand it) basically openLDAP with a config file and a nice GUI. Don't get me wrong, GUIs are useful, but if you want to go OSS, cut out the middleman.

Well, it's a bit more than that. With a few button clicks you can have a fully functioning Directory Service with OpenLDAP and Kerberos. You get password policies, single sign on for everything from mail to smb to web, and you even get a one click samba pdc.

The only thing it lacks is the groupware support. Firstclass or any number of OSS solutions can provide that.

Check out our site, or even just Apple's server site for more info.

Of course since the questioner didn't mention openLDAP to begin with,

Yeah he did, by name even.

Re:one caveat

[Raspberry]

Actually I can say I worked on one of the largest directories in the world... over 52 million user objects and hundreds of millions of objects.

AD does not scale well. Senior Mgmt wanted to move from eDirectory to AD due to some price breaks on desktop os and MSOffice for over 50000 employees... so we made the attempt with Microsoft in house providing consulting services... they eventually admitted even they couldn't get it stable in our large distributed environent... during the one year migration troubleshooting process we had contractors restarting servers in hundreds of locations around the clock.

We're now back on Novell eDirectory with Open Enterprise Server and stable again.

Re:3. Mac OS X Server

[plsuh]

Open directory is (as I understand it) basically openLDAP with a config file and a nice GUI.

Open Directory covers a lot more than LDAP. Yes, it's based on OpenLDAP -- in part. Yes, there is a nice GUI, which you can use to administer users and groups remotely, from another Mac OS X machine.

But there's also MIT Kerberos, integrated with the LDAP. When you create a user in Open Directory, the necessary Kerberos principals are created for that user. User identification (linking usernames with Kerberos principals and home directories) happens automatically.

But wait, there's more -- there's also the Apple Password Server, which is based on the SASL layer from CMU. This provides centralized, non-Kerberos password support, for things like CRAM-MD5 authentication, or NTLMv2 auth for Samba. The Password Server passwords are automaticaly synchronized with the Kerberos passwords. When you change a user password in the KDC the corresponding password is also changed in the Password Server or vice versa.

Still not happy? How about built-in replication support for load-balancing and high availablility. It covers not only the LDAP database via slurpd but also the Kerberos and Password Server databases?

Oh, and one more thing -- encrypted archiving built in to the GUI. Archive your entire set of LDAP user information and your password database to an encrypted disk image. Secure and convenient.

(Yes, I work for Apple -- but the parent post misses most of the good parts.)

--Paul

Mac OS X Server

[Aron S-T]

Cheap - $1K for an unlimited server license, and the Xserves come with the license and are great performers in their own right and cost-effective.

It has ease of use GUI goodness, with a full open source stack underneath: supports Open/LDAP directory services, single sign-on, kerberros, email, calendering (via WebDav), file services (via Samba for Windows and Linux), CUPS, Apache, DNS, Mailman - the list goes on and on. It plays extremely well in mixed environments and is extremely easy to administer - no steep learning curve.

It's far cheaper than all the other alternatives, including Novell and RH, not to speak of Microsoft. And soon you will be migrating all your users to OS X boxen as well once you see all the advantages.

I have done administration on all the other alternatives and I'm far from an Apple fanboy, so don't start flaming me on that score.

Some tips and a little more on Lotus Domino

[JDAP]

As this is my First! Slashdot! Post! Ever! (R), I'm hoping to avoid any crass errors in style or etiqutte..fortunately, based on some posts I've read over the years, there'a a pretty high bar. (Hopefully, smartass jokes are also OK.)

I've done a lot of work with a range of customers on implementing and maintaining directory infrastructure, mainly centered around Lotus Domino and the IBM Directory Server. To start the shameless plug, I'll say that based on your criteria - directory services and a groupware/mail solution - you should give Domino a hard look. A Domino server contains a totally integrated mail system (both fat client and web mail based), an application development platform with Java support, LDAP directory server, Web, SMTP, IMAP and POP server, predefined application database templates, and advanced security services like PKCS and SSL out of the box; it can also synchronize user information with Active Directories for centralized user account administration. Outside LDAP servers can be associated with Domino to allow those users direct access to resources like web-based apps. Current versions are shipping that run on Windows, Linux, HP-UX, and other platforms, which allows for platform flexibility.

To save this from becoming a sales pamphlet, there are some good reasons to consider other options depending on your needs. Some corporations demaand that directory services be highly integrated into the OS; Domino's directory is not, though it can share information with native services if they exist.

While Domino is great for having so many services instantly available out of the box, they are not necessarily best-of-class. If a very large, intensively utilized directory system is planned, then a dedicated LDAP server like the ones mentioned in previous posts may offer better performance. Some advanced LDAP features, like multi-master replication aren't included in Domino.

All that aside, in my opinion the most important things to remember in creating a directory services infrastructure is to plan around intended use and growth, not around products and glib promises a sales rep will spout. When you talk about the need to "set up directory services", take some time to plan what workflow will be used the most, what functions will need to be the most efficient, and what future applicaions and products will be hooked into the system. Create a concrete, detailed outline of what operations you'll need supported - signing people onto their workstattions is usually just the beginning.

After that's done, it's easier to look at hardware and software more critically to suit your needs - much better than fitting your needs to what a particular solution can provide.

Novell eDirectory ?

[morcego]

I would not entirely discart Novell eDirectory.
It is specially interesting on a mixed environment solution, and it does provide some interesting possibilities when coupled with Novell Client.

The pricetag is also VERY attractive.

Stark and Clear?

[clarkeb]

What do you base your stark and clear choices on? Banyan was the first company to come up with directory services. Novell really took directory services to the next level when it came out with NDS and NetWare 4. Wow one place to manage users, servers, printers, file system, DNS and DHCP, pretty cool. Well, Microsoft not to be outdone started calling NT's domain a directory so that they could compete with Novell. Novell threatened to sue MS about the false information on the MS web site about NT's "directory" and MS had to pull it. So, you guessed it MS had to have a directory and eventually after years, came up with Active Directory. Novell's NDS has evolved and MATURED, key word here, to eDirectory. eDirectory is a very scalable, over one billion objects, robust, LDAP v3 compliant directory services. Novell's Identity Manager product gives one the abililty to manange identities in a mutli directory/database environment. eDirectory runs on NetWare, Linux, AIX, HPUX, and Windows. There are other directories to consider including Sun, IBM, Seimens. Novell also has Groupwise email and groupware, and a pretty awesome desktop management suite, Zenworks, both managed in eDirectory. If I were you I would talk to the vendors and better yet talk to sites who have implemented AD, eDirectory and the others to do some due diligence and help make a good choice. Lot's of people think that Novell is dead. This is not true. Check it out.

Why not Novell?

[koamana]

OK. You didn't mention Novell's eDirectory. AD works for small networks. It might even work for medium sized networks. If you want something that is going to scale, Novell wrote the book on directory services. They have their Small Business Suite of products. If you want to cobble(?), kludge it together, well you can look at open source solutions. In my opinion, directory services from open source isn't quite baked.

Novell is all-in-one

[digidave]

Their directory far surpasses AD. You can also look into Netscape Directory.

For groupware, check out Zimbra (http://www.zimbra.com/). The Flash demo is great.

STOP....

[Alystair]

Hammer Time!

Easy: Novell

[ImaLamer]

Novell - well if you are a Novell shop, you will use NDS. You will use everything else Novell has. It is sort of like joining a secret cult.

Not true, you can use Novell's NDS (eDirectory, the LDAP server software) right on top of Linux, Unix, or Windows. The admin tools are almost all Java based or otherwise accessible so you aren't locked in there (clients and management tools for Linux, Unix and Windows). Novell can manage the rights, er permissions, er privileges for clients of any flavor (because a directory services solution is about managing the resources on the network) - and has less bloat and more security than Active Directory.

Novell is my choice hands down. It isn't the nightmare product it used to be. Quite flexable, scalable and for all intents and purposes "open". This product actually follows standards! In my experience it also prices cheaper for clients than Active Directory, although you never know because I'm sure it has changed.

The person who asked this question initially said that the only other option to Active Directory was A cobbled-together solution based as much as possible on OSS (as no direct equivalent exists)

This simply isn't true. There is eDirectory and it's better! (PDF) Wake up people! It's 2005 and there is a better option out there and to top it all off they are a Linux company too.

Re:3. Mac OS X Server

[hyc]

As far as I recall, the Apple Password Server is only provided for backward compatibility with previous MacOS releases. I don't wish to denigrate what Apple has achieved in shipping OpenDirectory with their OS, but anybody can install Heimdal Kerberos, OpenLDAP, and Cyrus SASL and get automatic integration of Kerberos principals with LDAP accounts and Cyrus passwords. All of these three packages support each other directly, out of the box. And likewise, since you can create a single LDAP user object with all of their Kerberos info, Unix info, and SASL info in one place, they naturally all replicate together. So there's nothing magic about OpenDirectory here. (Nevertheless, OpenDirectory is good stuff, and I'm sure it will be even better in the future.)

And yes, I'm on the OpenLDAP core team, and I wrote a lot of the code that makes Heimdal, OpenLDAP, and Cyrus SASL play together. It's been working well in the field for years. And for those people who have trouble getting configure scripts to connect everything the way they want, my company Symas Corp. offers pre-built binaries of all of these packages, already integrated, ready to run.

AD is no silver bullet

[Alioth]

Additionally - Active Directory et al. isn't as easy as people would lead you to believe ("It's Windows! It has a GUI! Therefore it's easy!")

We just had Active Directory rolled out here. Our performance problems were so bad we had to hire Microsoft consultants to try and figure it out - and these people from the company that makes the product took over a month to actually come up with a solution that ran only half as quickly as our old Novell system. Admittedly, it's a much bigger system than 100 users (and I'm glad I have absolutely nothing to do with it, it's a nightmare) but Microsoft Active Directory and Windows aren't some sort of ease of use silver bullet. In fact after seeing what trauma they went through, it's not actually any easier than a "cobbled together" OpenLDAP/Samba installation and a great deal more expensive.

Red Hat Directory Server

[PMoonlite]

For a supported version of the highly-regarded LDAP formerly known as Netscape Directory Server that runs on Linux, see Red Hat Directory Server. And to try before you buy, you can check it out on Fedora as the parent suggested.

Mostly Easy.

[wildjim]

I was involved in setting up a similar system in a prev. job.
Basically, if you're expecting to use A.D anywhere, you're really advised to stick to all-MS.

We worked hard on getting A.D. to play nicely with a Unix LDAP system, Bind (DNS), Samba, etc. and it just wasn't even slightly fun. There's quite a few hacks that they use, and they seem to expect an ability to dynamically-update quite a few things (e.g. in DNS) which was tricky to get going with Unix tools. On top of that, it will be expensive.

However, if you avoid A.D, and even Windows PDC's, it's actually fairly easy. OpenLDAP is mostly only tricky for Access-Controls, Samba 3 can do pretty-much everything SMB/CIFS file/print-related, and can auth. against LDAP easily.
We preferred Exim over Sendmail, Postfix, and QMail, but just pick the one you like best as they all do LDAP.
We installed Dovecot for the IMAP server -- does LDAP, too.

I think the main point is: if you use some decent (read: fully-compliant) LDAP server, or X.500 + LDAP shim, the rest of it can be whatever you like best.

I would like to put in a couple of other points:

• For what you're aiming for, OSS will do it all. (e.g. OpenLDAP, Samba, Exim + DSpam + ClamAV, Dovecot/Courier, SquirrelMail...). If you're prepared to give your staff time to test-drive and learn the products, it's probably money better spent rather than giving away in licenses.
  
• Pick OSS s/w that has decent docs. I find that to be a reasonable bench-mark for both its popularity and likelihood for it to stick around.
  
• If you don't care about OSS, I personally have had good experiences with Lotus Notes. It is fairly straight-forward to use and Admin, tries hard to use standard protocols (e.g. IMAP, LDAP, NNTP...) for non-Notes clients and the document-management abilities will make you wonder why you never thought about it before!
  However licenses start at £150-ish/user, and £3000-ish/server... (sorry if I mis-remembered those prices!)

I agree with the LDAP part...

[The Last Gunslinger]

- the problem with IBM's directory is that it sits on top of DB2. This abrogates one of the coolest parts about directories - that you don't need a DBA. And a mistuned IBM directory is an ugly, ugly thing.

But I take issue with this mythology...I work with IBM's Tivoli security solutions, most of which use the LDAP Directory Server under the hood (and, illustrating the beauty of *standards*, also tend to support the use of Novell, Sun, & MSAD). The underlying DB2 engine doesn't require independent tuning, maintenance, or administration in the vast majority of deployments. It isn't until you get into user populations of several hundred thousand that you start tweaking the DB2 parms...and the solution actually includes a detailed LDAP tuning guide that explains how and when you should tweak the DB2 and OS-level parms.

The notion of needing a DBA just to deploy the IBM LDAP is just silly...any tech capable of RTFM can handle a moderate implementation on his own.

Here's the kicker: Which would you prefer for performance and scalability? A directory that uses flat or proprietary file structures for data storage, or one that uses a scalable and reliable relational database engine? Seems like a big "duh!" to me.

And, as you mentioned...it's free. Go download it from IBM and try it out. If it doesn't work for you, or if you decide you can't do it without a DBA, well...you aren't out any expense. Export it all to an LDIF and bring in the next vendor.

SunONE Directory Server

[CrudPuppy]

While I would normally say use OpenLDAP, Sun has recently made a version of their Directory Server free and open source. Their GUI management is excellent, and it supports Multi-Master Replication.

In case you're not familiar with MMR, think about your normal scenario. Maybe you have 1 master server and 2 slaves, one for each physical location. with MMR, you quite literally have 3 master servers, all of which can be updated and will push the changes to the others. This means no more worrying about losing the "most important" server--they are all equally unimportant if lost!

Re:SunONE Directory Server

[Ath]

Wow. MMR sounds great. But it isn't. It's nothing more than a half-baked feature set compared to Novell's eDirectory. Since its release in 1993, eDirectory has supported partitions and replicas of the directory with full backlink support for all resources.

What that means is that you don't tie up your WAN link with unnecessary directory traffic sending sync messages when they aren't necessary.

What I find amazing is that people just reject eDirectory too often because it is from Novell. It is fully LDAP v2 and v3 compliance, so even if you don't use applications that support eDirectory natively, you can still get all the benefits with no downside. Active Directory, by the way, is not fully RFC compliance for LDAP v3. If you think it is, you haven't bothered to actually try using it in a scenario where v3 functionality is required.

In addition, if you really need a serious directory solution then Novell's Identity Manager really shows the strengths of their directory offerings. There is absolutely no such thing as an enterprise environment with a homogenous directory. With IDM, you can publish and subscribe between just about any "directory" available. Active Directory, LDAP, Notes, Exchange, other eDirectory trees, SQL databases, and just about any JDBC-compliant database.

Re:one caveat

[JourneymanMereel]

So because of a price break on OS and MS Office management decided to move 52 million user objects and change the backbone of the distributed network? For a large corporation, what you save on the "price break" for those 50000 employers is negligent compared to what the total cost of the project, long term and short term.

You obviously haven't worked with the management I have. Most decisions seem to be made based around golf buddy opinions rather than technical superiority.

If you are 100% MS use Active Directory

[Deviant]

I preface this with the disclaimer that if you have a large enough amount of unix/linux and Mac clients that you loose alot of the reasons for and functionality of AD.

When it comes down to it, in a Windows enviornment, Active Directory is second to none. With W2K3 they let you get much more fine-grained with your replication, site-links and routing than in 2K which caused some companies with many sites some slowness and issues (as some of the other posters have mentioned). It has gotten to the point where, when you have at least 2 servers for replication/redundancy, it is bulletproof, well understood, tested and trusted in the industry.

As with any other product you need to get the manuals and see the best practices for how MS would have you configure the tree, the sites and the security groups and permissions. I have seen people try to wing it because it has a GUI and the results are rather poor. Done right AD is a near flawless solution to the directory services problem. It lets you configure almost any setting on a 2K or XP workstation through Group Policy. It lets you implement a software deployment/management system (MS SMS) that will install/upgrade softare either on a user or a PC basis. It is cheaper than most of the other corporate solutions that lack this level of ease of control over the workstations.

People here talk about forced upgrades but I have clients still using NT4 domains, servers and workstations after 10 years and they have not been forced so that is rather BS. MS supports their solution and will keep it viable and steady far longer than many of these open source projects may well. It is something that, if your organization grows, it is easy to hire somebody to help maintain and interact with as it is the industry standard.

As a previous poster said, if you are a MS house already, just buy it already. If you are going to use Exhange even more so you need AD. It seems to be the clear choice.