PhxBUG - Phoenix BSD User Group

In the past I've done Samba 3 backended against LDAP. All in all it was smooth and just used a couple of shell utilities to do the user management, although you could technically manage several of the account attributes directly e.g. via a LDAP web interface for convenience. Didn't ever do any Kerberos integration on that project, and not certain really how that would fit in; maybe instead of direct authentication against Samba from the workstations, you could check for GSSAPI support in Samba which would allow it to interop with KerberosV.

Great idea for a topic though. ;)

yea ... the missing part is that samba can't be an AD domain controller. it can be a member server, which is what i sort of accomplished yesterday, but that's not what i need

heimdal can use ldap as a backend, but openbsd's heimdal in base is behind quite a bit ... plus, i'd have to mess around with telling it to link against openldap

for the windows boxes, did you just install pgina and go that route?

right now, i'm looking at apple's open directory. it seems like they've managed to get it all integrated ...

The mode we used Samba in was more or less NT4 domain controller (PDC) mode, which worked for what we were doing. It worked for a login server so we could handle centralized account management in LDAP.

Honestly, I came out of the project with the feeling that while it was neat, it was needlessly re-engineering something that Active Directory or did well already, and if the company needed it done, they might want to drop a few bones on it and do it right. Part of this feeling came from not having enough time to devote to managing it, and that every service pack Microsoft released for the OSes we were running (2000/XP at the time) crippled some piece of functionality, either forcing us to find creative ways to work around issues, disable functionality, or just give in and roll back to a native ADS domain. YMMV...

I worked with Samba years ago and thought it was thoroughly cool. Funny, but at that time I came to some of the same conclusions you did. Almost a decade later, with tons of good stuff added to Samba, and we're still in the same boat.

Now, I think it's pretty much a waste of time. Interoperating with a closed, moving target like MS is a constant battle you'll never win. They don't even have to try tactics like embrace and extend. They just do normal, closed source work, and it breaks older stuff. Why would they worry about it? It's their standard and updates take care of the Windows clients.

Lots of people use Samba, and it's a good product. If you choose that route then best of luck!