Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a challenge presented before me, and that is to centralise authentication. Period.

That's because me and my big mouth said I like LDAP, and anything can authenticate against it. I have pretty much every type of desktop here, Macs, Windows XP up to 7, and number of Ubuntu and Fedora based distro installs.

I have no problem going through all the configuration work. In fact that should be pretty fun, I just want some recommendations on which implementations I should be looking at.

Thank You

share|improve this question
    
Just so that people know, AD is not an option as the 'Primary Host' –  Mister IT Guru Jun 28 '11 at 11:43
    
Also, I would prefer not to have Apple OD as the 'Primary Host' either - please excuse my own in house freshman terminology! –  Mister IT Guru Jun 28 '11 at 11:44
add comment

3 Answers

up vote 7 down vote accepted

Natively, a Windows machine can only authenticate against an AD domain that it is in (or a domain that it trusted by the domain that it is in.) You can find replacement GINAs, I do believe that there's one for plain ol' LDAP.

However, once you've got an AD domain, you've also got Kerberos and LDAP as part of the deal. You can authenticate OS X against AD, and you could use PAM to authenticate the Linux machines against the LDAP part of AD.

share|improve this answer
    
And if you invest in Active Directory as your "root" authentication, you can add a Mac Open Directory server for managing those Macs. Look for articles about "the golden triangle" for that. –  Data Scavenger Jun 25 '11 at 19:53
    
I was planning on something like a golden triangle - I called it the Tertiary Adjunctive, (Voyager Reference), where I have one main database, and then had AD, Mac ODS both 'slave' off it, and also be able to do linux user authentication - and basically take over the world. –  Mister IT Guru Jun 28 '11 at 11:42
add comment

We use Micrsoft's Active Directory for authenticating our Windows, OS X and Linux machines. Active Directory provides LDAP, client configuration via Group Policy and much, much more.

share|improve this answer
add comment

I would put all the Windows machines into a domain, that makes centralised authentication very simple for them.

MAC's can authenticate against AD.

For the Linux machines I would use SSSD, which generally works together with Kerberos, which, if properly implemented, also allows password changes for both the domain account and the local account, and implements password caching for laptops. The sssd package should be available off the shelf for Ubuntu and Fedora (we use it in Debian Squeeze, and it works a charm).

For your various other apps, especially web apps, LDAP authentication is also relatively simple to implement, since most scripting languages have LDAP modules.

There are a few applications where you will run into trouble. Example: Microsoft Dynamics GP V10 and prior do not support LDAP/AD authentication, but it has been promised for the next version.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.