Active Directory vs OpenLDAP?

K

KapsZ28

2[H]4U
Joined
May 29, 2009
Messages
2,114
We have Windows servers using AD and Linux servers using OpenLDAP. Because of this, we need to maintain user accounts and permissions separately. Would it be wise to get rid of LDAP and start using AD for all the Linux servers? Pros and cons?
 
Pros - Unified single logins
Cons - You have to run a Windows host to do it

We run an entirely Linux production operation with the only exception being a RODC (read-only domain controller) that the main DC's in the office replicate to. Any remote access VPN or linux user login that connects to that network uses the RODC to authenticate, and should it go down, we simply change a DNS record and all new logins then point to the DCs in the office. It's served us well.
 
For LDAP, despite how annoying it can be at times, Windows Active Directory is the top dog by far.
 
Well, if I decided to move everything to AD, would I have any issues with the Linux servers? They are mostly CentOS and Ubuntu servers.
 
Well, if I decided to move everything to AD, would I have any issues with the Linux servers? They are mostly CentOS and Ubuntu servers.
 
I would stand up a test linux server and try it out before you move your production systems over.
 
I will definitely test, but we have quite a few Linux boxes performing different roles. I was hoping someone that may have experience in a heterogeneous environment could comment on whether this is even advisable.
 
If things are good the way they are, why are you considering the change? For the sake of change? Or are you tired of managing several user account databases? If it were me and the choice was left to me? I would have pointed the linux boxes to AD for authentication.
 
We are mostly a windows shop, but have no issues with the linux machines working with AD.
 
KapsZ28 said:
Do you have the Linux servers joined to AD? If so, are you using Likewise Open?
Click to expand...

The machines are not directly joined. But applications installed on them use AD for user authentication via LDAP queries.
 
Grentz said:
The machines are not directly joined. But applications installed on them use AD for user authentication via LDAP queries.
Click to expand...

So I take it you are logging into the servers with local accounts? My goal would be to log into the servers with AD accounts.
 
KapsZ28 said:
So I take it you are logging into the servers with local accounts? My goal would be to log into the servers with AD accounts.
Click to expand...

Correct, service accounts of sorts. Its not that bad for us as we have to keep track of service accounts for certain types of AD connected machines any how (like SQL servers). The main thing is using centralized user auth for user apps.
 
You must log in or register to reply here.
Back
Top