8
votes

Is there any good alternatives for active directory?

To clarify, after deploying and maintaining many Windows-only sites all using Active Directory, I started to wonder why I never thought twice about using something else, e.g. Linux. I understand that a full-featured alternative may not exist yet, but I'm at least looking for something that is aspiring to be active directory and working towards it.

1
  • 3
    What features of AD are you looking to replace? Group Policy, naming services, authentication, security groups? May 3, 2009 at 0:15

12 Answers 12

3
votes

Likewise-Open makes integrating Linux clients and member servers into an existing Active Directory fairly simple. We use it on a couple of Ubuntu servers for NAS -- just upgraded to Jaunty and it works great, though we stuck with the likewise-open (4.x) rather than likewise-open5 package, as there are some changes in the newest version which we haven't figured out completely. In particular, Likewise takes some of the overhead and configuration out of the krb5/pam/winbind/samba setup. Supposedly its authentication mechanism is more efficient too, but this isn't something that we've really noticed.

Also, the long-awaited Samba 4 is supposed to be coming in the not-too-distant future, and promises a number of interoperability improvements such as Group Policy support, might be worth staying tuned.

7
votes

I'm surprised no one mentioned Novell's eDirectory. It has been around since 1993 (Of course if was called NDS back then). http://www.novell.com/products/edirectory/whychoose.html

2
  • I have not used eDirectory personally, but one of my colleagues at a previous employer had come from an eDirectory shop and he was of the opinion that it was actually more flexible and feature-rich than AD -- which, I suppose, is a necessary posture for an "underdog" product to be successful.
    – Skyhawk
    Dec 7, 2011 at 18:54
  • This is something you hear a lot from people that worked with it. I don't think it was originally an underdog at all; it was the dominant directory product (that wasn't an NT domain) at the time. Active Directory displaced it.
    – TristanK
    Dec 7, 2011 at 21:22
4
votes

Samba/LDAP/Kerberos would be the only other option I'd consider.

2
votes

OpenLDAP can do the authentication part of active directory. I don't believe there's a replacement for group policy however on Windows.

It might help if you explained what exactly you don't like about Active Directory and why you're attempting to avoid it, I'm presuming cost?

2
votes

OSX Server provides a built-in open source stack to replace active directory based on OpenLDAP. It's not the easiest to get up and running but 99% of it can be done through the GUI and if you've got AD experience it's fairly straight forward.

Plus Apple provide support for getting things up, running and configured in case you get stuck :)

1
  • 1
    "It's not the easiest to get up and running" So long as you correctly configure forward and reverse DNS for your server, it's actually a walk in the park.
    – username
    May 11, 2009 at 10:58
2
votes

If you're looking for something in the SOHO arena, then "SME Server" may do the trick.

http://wiki.contribs.org

I recently found it and have been playing with it on a test box. It seems pretty solid.

It will take care of all the normal stuff; file/print sharing, web, email and NAT.

It will also act as an old NT style PDC.

A nice review can be found here http://www.theregister.co.uk/2010/11/17/review_sme_server/

1
vote

It depends mostly on whether Windows is involved as an AD consumer. If not, there's dozens of technologies to fulfill independent parts of AD:

  • LDAP/Kerberos: Authentication and user data
  • BIND/ldap2dns/djbdns: DNS domain naming
  • cfengine/puppet: group policy distribution and enforcement (someday these may run on windows too)

But here's the deal: Windows can't easily consume anything but AD, so you're stuck. Embrace, Extend, Extinguish.

1
vote

Second on eDirectory. It does everything AD can, but much more scalable and standards compliant and it runs on several flavors of *nix.

1
vote

Short answer is No.

No projects have ever gotten any kind of traction on aspiring to be a complete AD replacement. AD is an ecosystem with itself as the core, things like security, exchange, DNS, GPO are branches of this and these in turn are intertwined with Office, Sharepoint, SQL, Outlook, etc. Most projects that are out there are just replacements or replications of individual branches and mostly just so non-windows systems can tie into windows networks.

1
vote

You can join windows machines to Kerberos realms. When you do this you lose the rest of what active directory does. It isn't unlike configuring a Unix machine to use a realm.

The biggest disadvantage is that the machine doesn't automatically reset it's password. And groups. And policy. And, well, the rest of the windows management experience.

Here's a link on how to do it, though...

http://technet.microsoft.com/en-us/library/bb742433.aspx#EDAA

0
votes

You can make OpenLDAP/Samba/Kerberos work, but it's not the easiest thing to do. There's a lot of configuration you'll have to go through that is significantly greater than the amount of time it would take to stand up two Windows servers and make them DCs and be up and running with an Active Directory domain. And as indicated, getting GPOs and some of the other features (authoritative DHCP servers, Active Directory-integrated DNS, Active Directory Kerberos backed IPSEC policies, Exchange / OCS integration, etc.).

0
votes

I've had some good experiences with Kaseya. It is very script heavy but it provides a nice editor with lots of options. it runs an agent on the machine, so you can do basically anything that active directory could do, from changing passwords to pushing out policy.

There are tons of hosted exchange sites out on the internet that solve email issues as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .