Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Linux Software

How Linux Beats Windows in ID Management Ease 286

Posted by CmdrTaco from the what's-my-name-again dept.
Amy Kucharik writes "Fed up with Windows systems management? A Linux conversion may be your ticket away from the daily hassles of managing and licensing domain controllers and related software devices. In this tip, Paul Murphy discusses the evolution of LDAP and how using it, along with Linux, can make an administrator's job easier."
This discussion has been archived. No new comments can be posted.

How Linux Beats Windows in ID Management Ease More

How Linux Beats Windows in ID Management Ease

Comments Filter:

  • First LDIF! (Score:5, Funny)

    by Anonymous Coward on Wednesday July 13, 2005 @12:12PM (#13054967)
    dn: uid=anonymous, ou=linux, o=slashdot.org
    changetype: add
    slashComment: First Post!
    slashModLevel: +5 Funny

  • Mac OS X And LDAP (Score:3, Interesting)

    by Goo.cc ( 687626 ) * on Wednesday July 13, 2005 @12:17PM (#13055027)
    I remember reading a long time ago (before Panther was released) that Apple was going to transition Mac OS X from NetInfo to LDAP for management purposes. Does anyone know what progress has been made in this transition, especially with the release of Tiger?

    • Re:Mac OS X And LDAP (Score:4, Informative)

      by spiralscratch ( 634649 ) on Wednesday July 13, 2005 @12:45PM (#13055340)
      I know for a fact that OS X 10.3 (Panther) Server included OpenLDAP, not sure if it was there earlier. The whole package, with OpenLDAP, Kerberos, the GUI admin and such, is called Open Directory.

      More info here. [apple.com]

      NetInfo is now pretty much relegated to storing info for the local machine only.

    • Re:Mac OS X And LDAP (Score:3, Informative)

      by larkost ( 79011 )
      NetInfo is still used for the local accounts, and LDAP is one of the methods available for remote authentication (along with ActiveDirectory, Kerberos, etc...). This is all part of the OpenDirectory system, and there is no real sign that anything major is going to change.

      MacOS X Server uses LDAP as one method to store user information, and also NetInfo (as "local users" that can still be vended out).

      PS... this works very well, and is easy to admin. I don't see any reason to change things.

      PPS... the docum

  • How's this different? (Score:5, Interesting)

    by Anonymous Coward on Wednesday July 13, 2005 @12:17PM (#13055028)
    So how's user management via LDAP on Linux different from using Window's Active Directory?

    There's nothing concrete in the article.

  • Where's the article (Score:5, Interesting)

    by kiltedtaco ( 213773 ) on Wednesday July 13, 2005 @12:17PM (#13055034) Homepage
    I read the link. It sounded like a good introduction to an interesting article. Then it abruptly stopped. Where, if I may ask, is the actual article describing how one might use LDAP effectively for user management?

    Now I know somebody is going to say ARE YOU TOO STUPID TO USE GOOGLE!! No, I'm not. I'm simply saying that the article could have been much better, had they simply put actual information in instead of simply writing an introduction to the history of LDAP. As it stands, the article is exceedingly pointless.
    • Now I know somebody is going to say ARE YOU TOO STUPID TO USE GOOGLE!! No, I'm not. I'm simply saying that the article could have been much better, had they simply put actual information in instead of simply writing an introduction to the history of LDAP.

      Thank you for saying that - it needed to be said.
      My answer is ususally "I don't have time to google for the information and pick through the thousands of advertisements posing as real information."

      Why is that people have to cover up their own ineptitu

    • Actual information (Score:3, Informative)

      by lheal ( 86013 )

      Swoosh.

      Since it isn't possible for one article to explain how to configure identification, authentication, and authorization for all systems, the article contained [techtarget.com] links [kernel.org] to more [redhat.com] information [techtarget.com].

      That's because you often have to learn about things in order to do them. With flexibility comes a price, and that price is work. Luckily, they pay you for that, if you do it well enough.

      Or maybe he should have published a GUI along with the article? Sorry for being flippant, but I think you're expecting too

      • Re:Actual information (Score:4, Interesting)

        by dubl-u ( 51156 ) * <2523987012 AT pota DOT to> on Wednesday July 13, 2005 @01:17PM (#13055717)
        Since it isn't possible for one article to explain how to configure identification, authentication, and authorization for all systems, the article contained links to more information.

        Even so, the article was really weak compared with the blurb that they submitted to Slashdot. At 650 words, the article is barely an introduction to the topic. The links were a minor plus, but the article didn't really fulfill the promise of the title, let alone that breathy 50-word blurb.

        I would have been perfectly fine with the article if they had submitted it by saying, "LDAP has a neat history, and if you try it, you might learn something. But we won't tell you what or how, and we certainly won't show you how to solve any problems you actually have."
      • Thank you for responding more reasonably than the OMG USE GOOGLE respondants i'm used to. I still think that you're essentialy saying the same thing as them though.

        The point of an article is to show the readers something new. It's to help them, to teach them something, often on slashdot it's to show new ways of doing things. This article does none of these. It provides a few links, but little that google and wikipedia could not do.

        In your response you mention a GUI, alluding to a GUI vs. console debate. A
        • >GUI's are easier to use. This is just true.

          It's true, but it's like saying it's easier to drive a car than fly a helicopter. With a GUI, you can only do what the GUI-writer allows. With a command line, you're free to do what you want.

          GUI is fine for apps. For admin work, give me a CLI any day.
          • It's true, but it's like saying it's easier to drive a car than fly a helicopter.
            Dumb analogy. A helicopter is fundamentally different than a car. A helicopter flies. There is no similar fundamental difference with GUI vs. CLI. There's no reason a GUI can't do everything the CLI can.

            With a GUI, you can only do what the GUI-writer allows. With a command line, you're free to do what you want.
            With a command line, you can only do what the command-line app writers allow you to do.

            GUI is fine for apps. For

            • Re:Actual information (Score:3, Insightful)

              by lheal ( 86013 )
              There is no similar fundamental difference with GUI vs. CLI.

              Your claim is that the two are isomorphic, that is, that there is a mapping of every function of a GUI to a CLI and that all functions of a CLI are met by the GUI.

              That is clearly false, since while I can quickly issue a command under a Unix shell that will repeat until I kill it, GUIs never (or seldom) provide a checkbox for that. That's just one example. There is a limitless supply of examples, since I can create ad hoc command scripts to e

    • Re:Where's the article (Score:5, Insightful)

      by HrothgarReborn ( 740385 ) on Wednesday July 13, 2005 @01:33PM (#13055930)
      I have to agree with you. I have implemented LDAP systems and its no peice of cake. How do you get Windows and Linux using the same system? How do you deal with groups (there are at many different ways each with different applications supporting them)? What about tying in web applications? can you have a seemless sign on or do users need to reenter their password? What about security on those web apps; are they going to use basic, digest, NTLM? Are we going to syncronize with Active Directory or maybe just expand the AD schema? What about user provisioning and protecting sensitive data in the tree. What about tree structure?

      Basically if all I needed was a place to look up email addresses I can just throw up OpenLDAP on a linux box and be done. If I want identity management I need some real planning and some serious engineering. Even the comercial solutions like Novell is offing using eDirectory on Linux are complicated and resource intensive implementations in anything but the simplest environments.

      The idea of "it's Linux" so there is no throw away work is foolish.
      • Frankly, all of your questions can be answered very simply.

        Use Mac OS X Server. I know it can do all those things, via the GUI, because I get paid to do them. And they're pretty damn simple. And cheap to boot: $1000 for the server sw and an older G4 is about all you need.

        For an example, try this [apple.com].

      • Re:Where's the article (Score:3, Informative)

        by Cylix ( 55374 )
        A couple different places....

        samba.org has had its guides updated for more modern deployment. There are several places, but one of the better guides is listed with the same people who make the samba-ldap tools.

        Active Directory is a nightmware because a lot of what happens is done for you in a windows environment. Which is funny... a great deal of what goes on with normal samba is automated and you get to feel a whole lot more of that when you goto ldap. I'm sure someone has made some progress.

        Anyhow, onc

  • Feature Request (Score:5, Funny)

    by HMC CS Major ( 540987 ) on Wednesday July 13, 2005 @12:17PM (#13055035) Homepage
    I wish that Windows NT included some easy interface to LDAP for large corporations to manage all of their workstations ... like a directory. It could be used for logins, privileges, login scripts, mapping drives, controlling group policy, and even integrate with the mail and calendaring system. It would be one big active directory. That would be nice.

    • Re:Feature Request (Score:4, Insightful)

      by Anonymous Coward on Wednesday July 13, 2005 @12:25PM (#13055151)
      Haha :) You know, 90% of the people reading your post will not understand that you're being sarcastic. And not only is AD already there, you can get your Linux boxes to authenticate to the same infrastructure as well since AD is a Kerberos based technology. Not to mention that Kerberos is a lot more secure than the typical LDAP based user authentication implementation.

      I prefer to use Kerberos for Authentication and LDAP for authorisation. It is very secure, easy to administer and universally supported by the commercial vendors. However for some reason, it does not get a lot of press.
      • And not only is AD already there, you can get your Linux boxes to authenticate to the same infrastructure as well since AD is a Kerberos based technology.

        How?

        (I know how to use google, so a few keywords will be sufficient, rather than a drawn-out explanation).

        • Re:Feature Request (Score:3, Insightful)

          by drsmithy ( 35869 )
          How?

          If you just want simple authentication (ie: "is this username and password valid") then use winbind. Use this if you just have a samba server you want to auth back to your AD.

          For something more complex (like specifying unix UIDs, login shells, home directories, etc) you need to look at Microsoft Services for Unix (to extend the AD schema) and optionally pam_ldap/nss_ldap. I say "optionally" because SFU comes with a NIS server that can authenticate unix users - but you might not want to use NIS. Us

          • Re:Feature Request (Score:5, Informative)

            by schon ( 31600 ) on Wednesday July 13, 2005 @02:54PM (#13056836)
            For something more complex (like specifying unix UIDs, login shells, home directories, etc) you need to look at Microsoft Services for Unix (to extend the AD schema)

            Which (in my experience) just tanks your AD server.

            I've tried it twice, and both times turned my AD server into a doorstop - the AD service locks hard, and there's no way to bring it back.. which makes the entire machine useless (as you can't log in without AD running) - a reinstall was required to fix it.

            And apparently I'm not the only one this has happened to. [slashdot.org]
        • Depends on what you're using. On SuSE Enterprise Server you just go into YAST, click the kerberos module and put in your settings (and lots of directions are found using Google for this, although the only settings it requires are domain, realm and kdc server).

          I'm not as familiar with other distros though - so I'm not sure if it is as straightforward.
    • I agree, but rather than add this to Windows NT, which they don't support any more, perhaps they could make it a new feature in, like, Windows 2000 and improve it for Win 2003. If they could add a secure Kerberos authentication service to it and even allow it to be used standalone for applications (giving it a nice nickname like erm, EVE [microsoft.com]) they might have a real world beater on their hands.

  • Nice, but... (Score:5, Insightful)

    by mogrify ( 828588 ) on Wednesday July 13, 2005 @12:17PM (#13055040) Homepage
    I don't really get much from this article. Just that LDAP is out there, and that there are online manuals to help you get started. I figured that much out already. I'm not seeing much of a comparison between LDAP and AD/etc here. Anyone got some in-depth experience to share?

    • Re:Nice, but... (Score:5, Interesting)

      by j00bar ( 895519 ) <slashdot@@@flowtheory...net> on Wednesday July 13, 2005 @01:40PM (#13056006) Homepage
      Yeah. Shitty article. But... We use OpenLDAP for a single signon in house... it was really ridiculously easy... The best part is that you can simply paste additional schemata onto the same leaves... We started using it as the staff directory for our email clients... then we made it also work as the user database for a Jabber server... we then added a VPN server that uses Radius to authenticate off of it using the radiusprofile schema... then we turned it into a Samba3 domain controller using nsswitch by adding the sambaSamAccount and posixAccount schemata... The flexibility has been incredible... How is that better than AD? I don't know -- I've never used AD. AD from what I understand is accessible through LDAP. *shrug* -j00 -jag

  • My new GNU/Linux Distribution (Score:5, Funny)

    by Anonymous Coward on Wednesday July 13, 2005 @12:17PM (#13055041)

    I am pretty sure I am not the only Linux veteran irritated by the increase in its user-friendliness, and mourning the loss of the good olde Linux, accessible only to those who enjoy kernel debugging. This is why I have decided to launch a new GNU/Linux distribution which requires extensive knowledge of Linux and of the computer system's internals.

    The distribution shall be available in the combination of a floppy and a CD-ROM image. Why not only a CD-ROM image? I thought it would be a little too easy, and know you think that too; the CD-ROM is only accessible if you can read it, and this is why I provide a floppy: it contains an assembler and a linker, all you need to write a CD-ROM file system driver (and a partition driver to install the files). Here, I'll give you a head start: ISO 9660 specification [ecma-international.org]. Don't expect every task to be so simple, I won't be giving the answers each time.

    The distribution is somewhat minimalistic, but can do pretty much everything one demands from a modern computer.

    Obviously, all tasks are accomplished through the command line interface (no GUI is provided).

    A Web browser isn't included (as if you expected one to be anyway), just telnet to port 80 of the Web sites to surf the Internet.

    As for an email client, telnet to port 25 and learn how to use your email server.

    For FTP capabilities, you may telnet to port 21 and use the standard commands.

    As I have demonstrated, this is a very versatile and capable GNU/Linux distribution, meanwhile staying available only to real men who back up to FTP and not to tape (to ensure this, legacy support for tape drives is excluded).

    Since potential users may have varying levels of experience, I am hence providing different versions of the distribution:

    • a version without a TCP/IP stack, because I knew some among you would complain it would be too easy otherwise, so you can write it yourself from the floppy;
    • a boxed set for you novices out there, including the floppy, the CD-ROM, a modified version of telnet supporting Connection: Keep-Alive, and ssh for tinfoil hat-wearers -- and because I'm generous, I've added to the package a printed manual featuring the ISO 9660, HTTP 1.1, HTTPS and FTP specifications.

    Your suggestions are welcome, and I hope you enjoy using my GNU/Linux distribution.

    • I run Gentoo, but while hearing all these guys talk about how Linux has advanced on the desktop I have to wonder:
      • Why did it take me 2 hours to configure xorg.conf to get my laptop working in 1400x1050 properly when Knoppix did it in 30 seconds?
      • Why did I have to spend 3 hours writing bash scripts to make power management work?
      • Why did I have to use fdisk when Mandriva has graphical partition manager?
      • Why does Gentoo not detect my DVD drive when I use it in my other laptop?
      • Why doesn't my mouse work automat

      • Re:Funny because it's true (Score:5, Insightful)

        by kebes ( 861706 ) on Wednesday July 13, 2005 @01:32PM (#13055911) Journal
        Sure you can put Mandriva on a PC and it'll work fine forever for office stuff, listening to music etc. But if the user want flexibility and ease of use?

        You seem to be implying that there's something Mandriva can't do that all the other "more flexible" linux distros can. I'm not aware of such a thing. I'm not a linux guru... but I run Mandriva on a few machines and there's never been something that I wanted to do that I couldn't (remote administration, webserver, MythTV, etc.). I understand the "fun" of setting up a Gentoo machine... but if you want ease of use combined with power and flexibility, then use Ubuntu, Mandriva, etc. Everything installs easily, and then you can configure and fine-tune to your heart's content.
      • So, you wanted an easy to use, user-friendly, don't have to know anything Linux distribution. Then you chose Gentoo? Is that the first result that comes up in a Google search for Linux, or what?

        Go to Ubuntulinux.org. Really. Once installer CD and an internet connection later, you'll have your nice friendly install. Well, about as friendly as Linux generally gets. You don't even have to use fdisk - it'll do that for you.
      • Hmm... maybe try Suse... I just upgraded to 9.3 (Previously running RH9.0)

        Responding to your main points:

        * laptop working in 1400x1050 properly: Check - automagic.
        * power management works: Check - automagic.
        * graphical partition manager: Check - Yast2
        * plug-n-play DVD drive: Check
        * mouse work automatically: Check
        * alsa set up automatically: Check - aplay and alsamixer Just Work (TM).
        * Printer setup: Check - KDE kprinter "Add Printer" wizard, accessible right from the pri
    • I have no suggestions, but I do want to thank you for not being one of those jackasses who want to turn a beautiful Unix system into a Windows clone.

    • Re:My new GNU/Linux Distribution (Score:5, Informative)

      by Wylfing ( 144940 ) <brian&wylfing,net> on Wednesday July 13, 2005 @01:45PM (#13056047) Homepage Journal
      Just in case you missed the sarcasm, because you may have never tried to set up LDAP before, this is a reflection of what LDAP is like. It is not a product, it's a set of (impossibly arcane) tools with which you can create a product, over the course of several human lifetimes, that might have the same features as Active Directory. And it's got "Isla de Muerte" documentation -- nobody can understand it unless they already know how it works.

      • It is not a product, it's a set of (impossibly arcane) tools with which you can create a product

        Actually, no. LDAP is (strangely enough) a "Lightweight" Directory Access Protocol. It's convenient that it also happens to use the letters LDAP for that, don't you think?

        Lots and lots of different directory-like products can speak LDAP (AD, OpenLDAP, Exchange, Novell Directory, Sun Directory, etc), but LDAP itself is not a tool or product.

        You don't hear anyone saying "man I installed this sweet HTTP that

    • If I had any mod points left - you would have gotten all of them. First post in a long time that made me laugh out loud.
  • ... was an embarassment because OpenLDAP is a pile of junk compared to the quality of flagship OSS products like the LAMP stack.

    Thankfully, Redhat's new Directory Server (based off iPlanet's) should be much easier to use and deploy.

  • Very fluffy article (Score:5, Interesting)

    by fahrvergnugen ( 228539 ) <fahrv@hoLAPLACEtmail.com minus math_god> on Wednesday July 13, 2005 @12:20PM (#13055077) Homepage
    That's a very nice little starting point, but the article has no depth. A little meat, even a mention of connecting Windows 2k/XP desktops to an OpenLDAP system via SAMBA for authentication, rather than relying on an Active Directory, for example, would be welcome.

    And for the record: Active Directory design isn't, IMHO, harder than the design of any other well-administered LDAP-based authentication system. Further, I'll say that Microsoft has done a fantastic job of making the administration tools transparent and easy-to-use, and the integration of Exchange mail servers & NIS authentication via Services For Unix into the same tool is icing on the cake. Sure, the per-server licensing fees aren't cheap, but you do get what you pay for in this instance.

  • Poor article (Score:5, Insightful)

    by HyperChicken ( 794660 ) * on Wednesday July 13, 2005 @12:21PM (#13055101)
    The article just says "Windows ID management is bad. LDAP is better. Why is Windows' ID management bad? I'm not telling. Why is LDAP better? I'm not telling." It does nothing explain the position the title purposes.

    This isn't to say I disagree but calling this article "news" is like calling the OpenLDAP FAQ [openldap.org] news.

  • Nonsense, but not for the reason you'd think (Score:5, Insightful)

    by mrRay720 ( 874710 ) on Wednesday July 13, 2005 @12:22PM (#13055111)
    ID management's biggest problem will never be solved by Linux. Nor will it be solved by Windows.

    As long as we have people putting passwords on post-its attached to their screens, as long as we have people clueless enough to fall for even the most simple of social engineering, there's no real thing as a proper ID on a computer system.
    In my (amazingly wonderful) opinion, no system deserves the name ID management unless it has a genuinely good chance of doing so. Physical tokens or biometrics (aka built-in physical tokens) are a minimum.

    Well, unless you're after the account ID, but I think admins are normally more concerned about the ID of the person using the account.

    We need to stop barricading the windows when people are walking merrily through the doors.
    • Simple rule of thumb:

      In order authentication to be considered secure, at least TWO of the three ways of authentication need to be used.

      The three ways are of course information, property and biometrics.

    • As long as we have people putting passwords on post-its attached to their screens, as long as we have people clueless enough to fall for even the most simple of social engineering, there's no real thing as a proper ID on a computer system.

      I agree. I think a large part of the problem, though, is that people are being given unrealistic demands for digital security wherever they go, that simply ignore everything we know about an ordinary human's cognitive ability. Even if a user can cope with one or t

  • OpenLDAP (Score:4, Funny)

    by glamslam ( 535995 ) on Wednesday July 13, 2005 @12:23PM (#13055124)
    OpenLDAP is a snap! Its so easy to use, even a 10-year unix veteran can get it integrated with some systems assuming everything is setup properly and has been designed for integrating in this manner!

    Thanks SearchEnterpriseLinux.com!
    • assuming everything is setup properly and has been designed for integrating in this manner

      but even if it's not setup correctly, it's so easy to install you can fix the problem in a jiffy!

      thanks sun [sun.com]!

  • Novell NSure (Score:5, Informative)

    by michael path ( 94586 ) on Wednesday July 13, 2005 @12:23PM (#13055130) Homepage Journal
    Sure, Linux is one way.

    However, I'm very impressed by Novell NSure [novell.com].

    Do not overlook this product if you're looking for a solid LDAP based Identity Management solution.

  • Bad Summary (Score:5, Interesting)

    by tunabomber ( 259585 ) on Wednesday July 13, 2005 @12:24PM (#13055134) Homepage
    Pretty thin article- if you were expecting a detailed argument for why OpenLDAP is better/easier to manage than ActiveDirectory, you'll have to look somewhere else.

    He basically just summarized the history of NIS and OpenLDAP, then gave us a link to some documentation for setting up OpenLDAP. Have fun editing slapd.conf, kids!

    I was expecting that he'd at least mention Redhat Directory Server [redhat.com], which is the most interesting recent development as far as easy-to-manage Linux identity servers go.

  • eDirectory (Score:5, Informative)

    by malraid ( 592373 ) on Wednesday July 13, 2005 @12:25PM (#13055153)
    There's nothing better in ID management the eDirectory, either running on Linux, NetWare, or yes.... even Windows. MS always promises that the *next* Active Directory version will have the features that eDirectory had 15 years ago. True container based security and delegation, partitioning, replication, all with the greatest of use. Yes, it's more expensive that OpenLDAP, but WAY better.

    • Mindshare of a political movement (Score:5, Insightful)

      by SgtChaireBourne ( 457691 ) on Wednesday July 13, 2005 @01:05PM (#13055565) Homepage
      I agree. It's always the *next* version, upgrade, or patch for Windows that's the panacea. After that everything will work as advertised. Until then we just have to cough up enough money / hang on / maintain status quo / install a spare copy / etc. Shoot, we've been hearing about WinFS for what, ten or eleven years? It was supposed to be in Win95.

      One of the really tragic points is that although NDS and eDirectory were already ahead of what MS-Active Directory (AD) is now *ten* years ago. AD is suddenly what all the MS fanbois talk about to the exclusion of the more mature, secure, flexible, and compatible options like either eDirectory or plain ol' Kerberos + LDAP.

      Actually, most AD articles don't cover many facts or even how to operate in a multi-platform environment. Plus there are a lot of short comings *still* in AD like scalability, performance and interoperability with non-MS systems. These are problems that you don't get with eDirectory or plain LDAP/Kerberos.

      I'm sure part of it can be explained by the fanboi mentality where anything and everything from Redmond is great, especially the next version which is just over the horizon, etc. And that MS "valued" partners are more or less forbidden from looking at competing technology. Maybe other parts can be explained by MS' standard marketing methods, like the smear campaign against Novell.

      I guess more of it makes sense if one looks at MS like a marketing company, as other posters have pointed out, rather than a software company. Though to me that's a bit 90's. MS is now heavily into lobbying and is bordering more on a political movement than a technology. Talk of AD is then a way of signaling membership in the movement/ideology. That would be another way of explaining fanbois who ignore LDAP+Kerberos or products like eDirectory, not even doing shoot outs against these competitors. doesn't make sense.

      I miss the days the product comparisons actually compared useful tools and brought up the good and bad points of the ones examined rather than going over pre-approved 'talking points' I guess even Consumer Reports is no longer unaffected.

  • Key points in the article:

    -Backups in windows are really hard, but nobody ever wants to do them anyway.

    -Project Athena at MIT invented Kerberos

    -Sun NIS was originally called "Yellow Pages" in the 80's

    -LDAP tools included with linux let you manage users, but you can change them if you want

  • Bah -- LDAP is weak authentication (Score:3, Informative)

    by forsetti ( 158019 ) on Wednesday July 13, 2005 @12:29PM (#13055192)
    LDAP, is a directory service, or database, that also has the ability to verify ID/Pass pairs, which is the most basic form of authentication.

    For stronger authentication, using tickets for further authorization, use Kerberos. With LDAP, you must punch in your password repeatedly. Yes, it is the same password, but it must still be entered multiple times. In a properly Kerberized environment, you enter the PW once, and that's it. And, if desired, you can do some neat P

    And, to head off some arguments -- Kerberos is pretty easy to setup. It is, at least, no harder than OpenLDAP to set up.

    Try Kerberos -- you'll like it.

  • Where's the comparison? (Score:3, Insightful)

    by oringo ( 848629 ) on Wednesday July 13, 2005 @12:32PM (#13055227)
    The title of the story is "How Linux Beats Windows in ID Management." Okay, I read the TFA, and all I read was an introduction to LDAP. Where's the comparison that shows "Linux Beats Windows?" The article is not even about linux; it's about LDAP solutions that can be run on *nix systems. For the love of God please please don't run stupid stories like this again.

  • Article improperly credits Project Athena for PAM (Score:5, Informative)

    by Otterley ( 29945 ) on Wednesday July 13, 2005 @12:43PM (#13055319)
    The article incorrectly states that PAM (Pluggable Authentication Modules) came out of Project Athena.

    However, it was actually invented by Sun, and was eventually adopted as RFC 86.0 by the Open Software Foundation [opengroup.org] in 1995.
  • Fed up with Windows systems management? A Linux conversion may be your ticket away from the daily hassles...

    Flame me for this, but Windows is a hell of a lot easier to learn and manipulate for the regular Joe users. In windows, if you want to change settings, you hit Start, Settings, Control Panel and you just select what you want to play with. In Linux, you actually have to know [redhat.com](very well) what you're doing [openldap.org] and how to do it. Now compare this. What will common users choose? Ease of use and user-friendli
    • Err, directory services aren't easy to setup even with MS solutions. The directory everyone seems to sing praises of is Novell's.
    • I think you have forgotten the time and effort you made when you learned to use windows.

      To use an old analogy:
      Windows is like buying a car with the hood welded shut. Buy a new one when this one breaks.
      Mac and OSX is like buying a luxury car. Lots of status and high-performance for driving to the market.
      Linux is like owning a formula 1 race car. Very high performance, modifiable, and now with very attractive body. It has a hood you can open and modify to do exactly what you want. All at a very attracti

  • LDAP != Identity Management (Score:5, Interesting)

    by flanker ( 12275 ) on Wednesday July 13, 2005 @12:45PM (#13055344)
    The author obviously has never dealt with any real IdM issues at a large company. With mergers and divestitures constantly happening, you end up with a patchwork of HR systems, facilities management systems, access request systems, application data stores and authentication systems. Saying "use OpenLDAP for IdM" is like saying "this paper airplane flies well - if you throw it hard enough, you can get it to the moon."

    This is not to say it couldn't be part of the solution, but the end state is going to have a bunch of different components.

    And MS's out-of-the-box tools (e.g. AD Users & Computers) are deeply pathetic for anything other than casual directory browsing. Third party tools are needed for the variety of different tasks involved in managing an AD-based NOS.

    That being said, some of the cool new work being done with Samba taken with a Kerberos KDC for authorization and OpenLDAP for authentication could be a good place to start in building out an IdM system. Unfortunately, you would really need to be starting from scratch to have this be feasible....
    • You hit the nail on the head. I am working on a project installing the Novell identity management system at a very large enterprise that has grown by aquisition. Huge challanges in getting everybody talking to the system.

      Fortunately Novell has done great work how it approaches it. In a nutshell there is a master repository will everyones data in it. Data is fed in through standardized XML feeds. Plugins are available for common data sources like PeopleSoft and AD to translate their data to XML. Then this m
  • Didn't redhat just release the new fedora directory server, based off of netscapes code?

  • Useful Utility (Score:4, Informative)

    by alistair ( 31390 ) <(moc.padltoh) (ta) (riatsila)> on Wednesday July 13, 2005 @12:50PM (#13055384)
    Since the article didn't really say anything about managing LDAP or playing with OpenLDAP, I thought I would share a useful utility my team has recently started using for LDAP management and administration.

    Have a look at JXplorer [jxplorer.org] (or alternate Sourceforge [sourceforge.net] link).

    It's a really nice open source LDAP administration and management utility that not only lets you do the easy entry editing stuff but a lot of the more complex tree management operations. It also has some really nice search building interfaces. I'm in no way connected with this project but it has replaced a number of free and commercial utilities we used to use.

    It also lets you play with populating an OpenLDAP installation so you can begin to understand some of its real power and tuning potential.
  • So we learned what the history of LDAP is and how easy it is on linux. But what about other systems etc...
    Not a good article. Slashdot has reached the prime of its peak and is now in its decline.
    This might be better
    Guy is strapped down into a pack of pressurized tanks and launched into the air.
    It is windows media file but xine and mplayer under linux (x86) can open it.

    http://www.lookatentertainment.com/v/v-1169.htm [lookatentertainment.com]
  • Ok, I give. LDAP is initially hard to understand (objectclasses, schemes, replica's, DNs), but once you do, it's a snap.

    Here is my real world setup.

    1. RedHat Enterprise server
    2. OpenLDAP
    3. Postfix (SMTP auth, Spamassassin, TLS, Postgrey)
    4. Cyrus Imap Server
    5. Samba File server
    6. Apache WebDav

    Right now I have a master copy of LDAP on the internal file server. Then two other servers (on the DMZ) are replicas. Samba pulls info from LDAP, Cyrus, Postfix, WebDAV as well. Not using Kerberos at this time, bu
  • All op-fluff without even coherent editorial never mind subject matter. If /. cannot stop dupes because no one is reading them, it should follow that the articles being linked to aren't being read either.

    I wonder how long till someone writes a three paragraph submission linking to goatse and tubgirl and it gets through.

    In the meantime, Windows has point and click administration and the only people who find it difficult are beginners and people from other platforms. Exprienced Win admins don't tend to ha

  • So Wrong (Score:5, Funny)

    by WindBourne ( 631190 ) on Wednesday July 13, 2005 @01:37PM (#13055970) Journal
    First it is not LDAP, but LAPD. Everybody knows that it is the LAPD that beats on others. So now, Paul is haveing the LAPD help Linux beat Windows. Cool. Can not wait until the law suit.

  • Meaningless fluff (Score:4, Informative)

    by glenmark ( 446320 ) on Wednesday July 13, 2005 @01:54PM (#13056175) Homepage
    Not only is the article light on content, but it is rather meaningless to argue that LDAP is better than Active Directory, since AD is an implementation of LDAP (featuring Kerberos authentication and the LDAP data stored in a multimaster replicated database).

    Of course, it has taken MS a while to catch up with the features Novell's NDIS directory offerings, but they are finally getting it right with 2003, and it is arguably the easiest to manage enterprise-scale LDAP implementation around. It isn't perfect mind you (we dig up plenty of bugs), but does seem to be the best thing going. Furthermore, Group Policy Objects are a seriously kick-butt feature. Besides, nothing else can properly issue authorization tokens (SID keychains) for Windows clients.

    Now if only they would fix the huge heaping piles of Exchange integration bugs in Entourage...

    (No, I'm not a MS apologist. They piss me off on a regular basis, both in terms of product quality, or lack thereof in many cases, and in terms of business practices; however, folks are barking up the wrong tree where these criticisms of AD are concerned. In a short time it has matured into a quality product.)

  • my experience with this configuration (Score:3, Informative)

    by graham the pet fish ( 899586 ) on Wednesday July 13, 2005 @01:55PM (#13056182)
    I've looked into using Linux with OpenLDAP, SAMBA and Kerberos before and in it's current state it simply isn't going to work as a replacement Windows domain controller.

    All the key components exist, but none of them are well enough integrated to provide a convincing solution. Notably, Windows machines that log onto a domain use a microsofti[sz]ed version of the LDAP standard, CLDAP (Connectionless LDAP) which from my understanding OpenLDAP doesn't want to support because it's non-standard. This makes it's unsuitable for a Linux-based domain controller but suitable for most other tasks. Also, SAMBA 3 doesn't support Kerberos as an authentication backend, and so password synchronisation and single signon is difficult in a mixed windows and *nix environment.

    The up and coming SAMBA 4 is promising to fix these shortfalls, with an inbuilt implementation of CLDAP, support for Kerberos authentication, etc. Until this happens, SAMBA and LDAP aren't going to meet the requirements of most medium size businesses as a replacement domain controller.

    The lesson I learnt from my research is that a Windows server currently makes more sense for a Windows environment for things other than relatively simple implementations that a Linux one.


    Graham

  • Linux sucks at this.... (Score:3, Insightful)

    by jozeph78 ( 895503 ) on Wednesday July 13, 2005 @03:03PM (#13056931)
    This post won't make me many friends here

    WindowsAD(Win2k3) + SQL Server + Exchange + .Net or VBS WMI = Extremely simple administration.

    LDAP is like 5% of what AD provides. Remember that AD offers authentication as well as OS level authroization. I don't know of anything in the Linux world that offers that just by running through a wizzard (ever set up AD?). You don't have to type anything if you don't want too, and for the programming heads, WMI/ADSI can do what isn't in the tools. There are also a lot of 3rd party products that can plug into AD.

    True they bastardized the Kerberos implemention and you are locked into windows but without an enterprise wide OS level authentication/authorization Kerberos SSO model available you'll never convince a CIO to go linux with 20,000 desktops. IMO it's the reason that linux fails as a desktop. You simply can't sell it to corporations, even though it's free. Plus windows does much better to protect your system files than Linux, where any admin could use root to read any file without knowing it was done. In windows, you own your files and can restrict even domain admins access, unless they take ownership, but then they can't give it back.

    You can linux vs windows all you want but Windows kicks the sh** out of linux when it comes to managing and administrating large environments. I also feel that windows has a much better security model and short of being the #1 target for hackers, has the potential to be much more secure than any Linux I've seen, short of SE Linux which does NOT make administration eaier at ALL. In fact I'll say that Windows is too easy to administrate. It still takes thinking like an admin to do it well but the truth is you could train someone who worked at Jewel's to administrate AD in about two weeks (it happened at my old gig). After using linux(Gentoo) for 6 months now I've determined that linux is the best system to work on and Windows is the best system to work in.

    Flame on.

Slashdot Top Deals

Know Thy User.

Close