Slashdot Log In
Fedora Directory Server 1.0 Released!
Posted by
Zonk
on Sun Dec 04, 2005 06:28 AM
from the like-a-kid-with-edubuntu dept.
from the like-a-kid-with-edubuntu dept.
LnxAddct writes "NewsForge is reporting that the first official release of the Fedora Directory Server has been announced. This is good news for members of the open source community longing for an easy to use, enterprise class directory server. Fedora Directory Server is based off of Netscape Directory Server which Red Hat purchased a year ago and released as open source. Screenshots are available on their site." NewsForge is a Slashdot sister site.
Related Stories
[+]
Fedora Core 5 Available 327 comments
Jan Slupski writes "New release day today. Fedora Core 5 CD images are now available for download (i386, ppc, x86_64) on the ftp servers or via the torrent page." Linclips also has a short screencast on some of the default functionality.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
command line (Score:5, Interesting)
A fancy GUI [redhat.com] is all very well, but does this come with some decent command line tools to scriptify adding and removing users and the like? One of the things that's kept my department on NIS for so long is that absolute hideous unfriendliness of the OpenLDAP tools vs useradd, usermod and friends.
Re:command line (Score:3, Insightful)
However, I find it interesting that you describe OpenLDAP as "absolute hideous unfriendliness" when it simply isn't that case. Granted that the ldif format isn't obvious or familiar, using the command lines tools is actually rather simple. You only need to understand how an LDAP Directory works, and how your schema of choice is laid out.
I have personall written a front end for managing userspace in OpenLDAP via bash scripts, and I can tell you that once I spen a hour reading up on ldif, it w
Re:command line (Score:3, Insightful)
Re:command line (Score:5, Informative)
my @validsalt = ('a'
my $salt = $validsalt[rand(64)] . $validsalt[rand(64)];
my $test = crypt($cleartext, $salt);
Of course, you'd also want to do some basic validation of the inputs. Then just wrap the user inputs in an LDIF template and run. It sounds a lot more difficult than it actually is.
The schema can actually validate that userid is unique, but you should check anyway and also validate the groups and gids.
Parent
Re:command line (Score:2)
Every admin in the world must write his or her own script to add a user to the directory.
Why can't we have ready-made programs that perform such simple tasks?
Like useradd, for example.
Re:command line (Score:2)
Re:command line (Score:3, Informative)
Scripting languages and LDAP (Score:2)
So even if Fedora's directory server doesn't offer any console tools (i dont know if it does), it won't be any problem making scripts manipulating its data. Take a look at this example on howto remove a record, its from the python-ldap site, and it isn't exactly overly-complex to use from the looks of it
import ldap
try:
l
FANCY gui? (Score:2)
Re:command line (Score:2)
Re:command line (Score:3, Informative)
wow (Score:5, Insightful)
Re: wow (Score:5, Informative)
Parent
Not the first time. (Score:5, Informative)
However, this story is just a bit more complicated.
RedHat open-sourced all of the code they could, which was quite a bit, but originally just the main directory daemon, ns-slapd, a few shared libraries and command-line tools were open source. The real news here is that the last of the "other" bits have finally been re-written under a new (open-source) license.
That's part of the motivation for resetting the release nubmer; note that this is verison "1.0" instead of (grumbles about memory) 8 or 9?
So now, it is a 100% open source solution, no more binary-only rpms.
Parent
Re:wow (Score:3, Informative)
Sun paid $88,000,000 for Star Office. (Score:2)
Re:wow (Score:5, Informative)
Regards,
Steve
Parent
+ Kerberos ? (Score:5, Informative)
with Active Directory.
Does the Fedora DS intergrate those two neatly, single sign on is neat, but OSS provides
no turnkey solutions for this (yet).
Re:+ Kerberos ? (Score:4, Insightful)
Really, I'm not trying to troll here, I'm just really not seeing what this need to click a single button for every possible setup comes from. Rather than trying to provide every possible setup from the start, as Microsoft does (and which much of the complexity in Windows derives from), isn't it better to have a generic solution that can be tailored to one's specific need, instead?
Parent
Re:+ Kerberos ? (Score:2)
It's one possible measure for the amount of care that's put in the product. You can say this doesn't go for this particular product, but lots of times adoption of a product starts with someone who has 15 minutes of spare time.
If the product doesn't show a few nice things within those 15 minutes, it just might be possible it's not looked further into.
I'm not saying this is the correct procedure to evaluate an important piec
Re:+ Kerberos ? (Score:3, Insightful)
Yeah, because it's not like this is a well used 'feature' in Windows Domains in just about every large company...
Re:+ Kerberos ? (Score:5, Insightful)
Largely, I think it boils down to - 'because they don't understand the technology as we do'. Take a simple, high level requirement: identity management. You or I might see that in terms of the components: such as a directory, an authentication service, creation & removal scripts, some means of replication, monitoring scripts etc.
A $notnerd sees the requirement as a black box, they don't care about the internals. They've probably been told by some techie/salesman that it will address some problem they have. For this person turnkey seems perfect, $company sells $product which is billed as an 'identity managment solution'. A magic black box solution to a black box problem, their work is done - now it is IT's problem.
To you it isn't, but what happens when you leave? It's much easier to recruit someone to maintain a push button solution, than a partly bespoke ecology of components and scripts. Often the solution and the ecology are similar in complexity, but the solution hides that behind a GUI and glossy marketting material.
Purchasers often chose to spend their money on specialised software (solutions), hopefully saving time. We often choose to spend our time customising general purpose software, hopefully saving money.
Alex
Parent
Re:+ Kerberos ? (Score:3, Interesting)
I agree completely with that, but my main point is that I think that this "turnkey solution" should be a separate pro
Re:+ Kerberos ? (Score:4, Interesting)
Parent
Re:+ Kerberos ? (Score:3, Insightful)
Oh that's just egotistical rubbish! People like turnkey solutions mainly for two reasons:
1.) They're novices and they just want something that works
2.) They're not novices, but they're overloaded with work and they don't want to learn the complete ins and outs of yet another massive, complex software package (note I said package, not the protocols it uses, etc).
Re:+ Kerberos ? (Score:3, Insightful)
Because it makes deploying them easier, quicker, cheaper and less dependant on a particular individual's (or individuals') knowledge.
Re: Who needs turnkey (Score:3)
I think it's because the domain of technical knowledge is so great that it's really quite difficult to grasp it all. If you're a small or medium sized company you may not have someone who really understands Kerberos and LDAP. Your sysadmins may know everything in the world about mailservers, webservers, DNS servers, DHCP servers and database servers but very little about AAA servers, Kerberos and LDAP. Look at the security community which is still farily young. People are already starting to specialize into
Re:+ Kerberos ? (Score:2)
Common signon for Linux machines is all very well, but you've been able to do that with NIS for years.
Get Carter. (Score:2)
Gentoo package? (Score:5, Interesting)
I've searched used such strings as "ldap", "nss", "directory" etc - but nothing comes up too interesting.
Re:Gentoo package? (Score:2)
More seriously, I will check out depencies. As I have rather big interest in this product, I will check out If I can't contribute an ebuild.
Interesting, but is it Good Enough(tm)? (Score:2, Insightful)
The first problem is that Netscape probably didn'tadd much to their Directory Service towards the end, and it is unclear how much
Re:Interesting, but is it Good Enough(tm)? (Score:5, Interesting)
The first problem is that Netscape probably didn'tadd much to their Directory Service towards the end, and it is unclear how much Fedora has had to put resources into code cleanups and bug fixes, as opposed to adding the capabilities it is going to need.
Red Hat / Fedora Team spent about a year cleaning it up and porting it to linux, or didn't you bother to read the summary?
For this directory server to be of much interest to network administrators, this package absolutely must support two-way communication with Microsoft Active Directory's LDAP. It can support more - and it would be great if, for once, Open Source "embraced and extended" something from The Other Side...
Uh? What does it need? 3-way communication with AD? 4-way? Active Directory is just a bastardized for of LDAP, and even OpenLdap includes the bits needed to work with it. What you are saying here doesn't make any sense.
To be of interest to system admins, it needs to work with PAM and preferably one of the standard "unified" admin interfaces, like Webmin or (yes, it is still used) linuxconf, in addition to specialized tools.
What you are saying here demostrates a complete ignorance of PAM, LDAP, and directory services in general. PAM has long supported LDAP, as has the NSS libraries. Webmin and Linuxconf are two interfaces the people have added as a layer on top of existing services. Nothing NEEDS to work with them, they support whatever they want. FDS has a great GUI and that is the point. Otherwise, an LDAP service is a usefull as the schema you load and how you implement it.
I like Fedora's distro, it is simply that if they are neglectful of something they can do in a script and a makefile, and of mere patches they had already made public, then how confident can I be of their ability to maintain a very complex piece of software?
Ok, seriously, get a clue. If you are looking for assurance, pony up some cash and buy the fully supported Red Hat Directory Server. Frankly, I think the entire Fedora effort is great, but I wouldn't run any substatinal business on it. For that I pay for Red Hat.
Parent
Re:Interesting, but is it Good Enough(tm)? (Score:2)
Re:Interesting, but is it Good Enough(tm)? (Score:4, Interesting)
Red Hat / Fedora Team spent about a year cleaning it up and porting it to linux, or didn't you bother to read the summary?
"Porting to Linux" is and of itself a mindless statement, since this is Netscape DS, aka iPlanet DS, which is an antique fork of Sun's current SJES DS, all of which have been running on Linux for better part of a decade.
It will be interesting to compare Fedora DS to Sun's current offering. Sun even provides an open source tool for this called SLAMD [slamd.com].
Parent
Re:Interesting, but is it Good Enough(tm)? (Score:3, Interesting)
To really understand this move by Redhat, it has to be taken into context with last weeks news about Sun open sourcing their enterprise applications, one of which is iPlanet Directory Server. iPlanet Directory Server and Redhat's both forked from the same N
About the console (Score:2, Interesting)
Its like you press a button, then you have to wait for 10 seconds before anything is happening. On Enterprise 4, everything is about 50 times faster, maybe even more.
The main difference here should be 2.4 kernel versus 2.6 kernel, but what makes the console that much faster on 2.6?
Re:About the console (Score:2, Informative)
It is probably trying to do some kind of lookup, ipv6 or your nameservice, you did configure your
ldap schmel-dap (Score:3, Interesting)
There are so few standards around LDAP authentication that it is impossible to support "LDAP" - you have to support MS Active Directory, Oracle Info Server, Novell eDir, etc..
For example, there is no standard way to handle password expiration. Every directory does it differently. There is no standard location or hashing algorithm for user passwords, nor is there any sort of standard password policy (password complexity rules, maximum retries until lockout, etc)
So we basically had to rewrite support for all these things that we already had in a modular fashion so now administrators are stuck configuring "the AD plugin", or "the OIS plugin"..
Re:ldap schmel-dap (Score:2, Insightful)
RFC 2307 - using LDAP to provide a Network Information Service.
Almost everything you touched on is covered in that RFC. So the standards exist, but Microsoft/Oracle/etc chose not to adhere to them by creating their ow
Re:ldap schmel-dap (Score:2, Insightful)
Additionally, who cares if it's not an official standard? The original poster said that LDAP is flawed because Microsoft AD, Oracle, and Novell all use different schemas within their directory products. That has nothing to do with LDAP (the protocol), and everything to do with the design choices those companies made.
Re:ldap schmel-dap (Score:2)
Sam Carter (Score:3, Funny)
I a n00b with a question (Score:2)
Re:I a n00b with a question (Score:2)
Re:I a n00b with a question (Score:2)
In general directory servers are based around the OSI X.500 model and DAP.
A good bit of info is here:
http://www.kingsmountain.com/ldapRoadmap.shtml [kingsmountain.com]
FYI you can thank the amazing team at University of Michigan for LDAP. Go Blue!
Open Bottom? (Score:2)
Re:Java Enterprise System from Sun is better produ (Score:2, Informative)
But does anyone really want an older version that's likely been untouched for years?
Re:Java Enterprise System from Sun is better produ (Score:2)
I think that the Fedora directory Server is late, and it is based on old versions of Netscape Directory Server.
Yes, it is late. Plus I find it disturbing some parts of it have special licensing concerns. And being version 1.0.... hopefully they will write this code out in time.
But it's strengths are that being based on the Netscape server gives it a boost in functionality over Open LDAP. I often wondered why Open LDAP seemed to almost stall in it's development.
So I will still be using Sun One Directo
Re:Nice to see (Score:3, Interesting)