Our office has switched almost entirely from Windows to Mac OS X, and our local server is due for replacement. We use Active Directory basically just for user authentication. We're considering replacing the current Windows Server with a Mac Mini running OS X Server. I don't yet know much about Open Directory, but is it possible for it to proxy authentication requests against a SAML v2 Identity Provider? I ask because we do quite a bit of work in a management system that is capable of acting as a SAML 2 IdP and we have set up Google Apps to authenticate against it. It would be extremely helpful to be able to authenticate local network resources against it as well.
Open Directory has an LDAP backend so you would use something like simplesamlphp with LDAP to get what you want.
However, some big caveats.
If you’re happy with your Windows Server experience there are very few compelling reason to switch to OS X and Open Directory. Apple has put a lot of work into making OS X a good Active Directory client. For a broad overview see their whitepapers on the topic:
Migrating from one directory system to another one is a big project and AD has superior vendor support from Microsoft. I say this as a system administrator who has used both products extensively. Every version of Open Directory I’ve deployed has had a significant bug sooner or later. The last one I encountered was a bug in Mountain Lion Server's LDAP authenticaton that caused the server to crash every ~24 hours when under normal load. The workaround was a script that restarted the service every hour. The real fix didn’t come until Mavericks was released. Apple never acknowledged the bug in any release notes, nor did normal AppleCare. To get any help (in this case, acknowledgement of the bug and that our workaround was the correct workaround) came from enterprise AppleCare.
If you really want to migrate to an Apple server then the enterprise support contract is mandatory. You can get more information on it here:
Hope that helps.
If your AD environment uses Kerberos for authentication, then in principle, moving from the AD functions to a combination of a Kerberos server (e.g. MIT's krb5) and an LDAP server would work (running on Linux). Mac OS X clients supports Kerberos authentication and SSO; Safari (and Chrome, Firefox) support SPNEGO extension for handling Kerberos auth over HTTP. OAuth2 or SAML IdP is a mechanism for proving the identity for your users to external service providers (e.g. Google Apps).