Hacker News Reader

Comment by artonge | Hacker News Reader

Can you explain the difference with openldap ? I have never used AD, and I am satisfied by openldap, I mean once I understood how to configure it...

View on HN

> I mean once I understood how to configure it...

AD is a misnomer. It's not simply a directory. It not only does what OpenLDAP does but also what Kerberos does.

Openldap is aweful to configure by the way. The documentation is terrible, sometimes lacking important piece of information. I remember TLS being a pain to setup. Actually I think everything having to do with authentication (PAM, OpenLDAP, Kerberos, nss) on Linux is a pain to setup.

By comparison, AD is fairly nice.

OpenLDAP is just a lego piece of an actual equivalent, you would need a schema and a ton of configuration to use it as a user and authz directory. A better equivalent to AD would be FreeIPA, which is 389ds (LDAP server, similar to OpenLDAP) plus Kerberos plus OS integration and admin tools. However, the config and install part that AD has would still be separate in something like puppet.

AD can be very roughly described as LDAP with a better interface, a consistent implementation and some proprietary extensions. You don’t need to fight with incompatible clients and have a decent UI. For the rest it is conceptually quite similar.

Schema versions in AD are problematic. Not every Windows Server version works with every Windows Client version. You always need to consult the support matrix, and for additional software like exchange that uses AD schema extensions, it gets even more complicated. So yes, if you are not strictly standardized to a single generation of Microsoft products, you do need to fight incompatible clients and servers

You can join any Windows 2k+ client to any version of Windows Server from 2000 onward, with the exception of Windows 10 to Windows 2000 Server, due to Win2k relying on SMBv1 for stuff. If you activate SMBv1 on Windows 10 it will join fine. Schema extensions are a different story, but I'm almost certain that nothing in that department has changed since Windows Server 2012. If you are doing a new Exchange install now and can't buy some upgrade licenses (or get an EA with Microsoft), you probably should be on Office 365 anyway.

There's issues with Windows Server, sure, but AD and its relatives aren't one of them.

Reply on news.ycombinator.com