11
votes

I'm looking for a good open-source alternative to active directory that can handle:

  • Authorization/Authentication
  • Group Policy
  • Replication and Trust Monitoring

In addition, are there any consolidated systems out there that handle these responsibilities?

Edit: Since a lot have asked for more details, I am trying to offer a service setting up an infrastructure for organizations, hardware/software setups, right now I am looking at a Linux stack, both desktops and servers, however a hybrid stack is possible, and I am investigating alternatives.

3
  • 5
    Out of curiosity, why not use Active Directory?
    – mrdenny
    May 28, 2009 at 1:22
  • Which client and server operating systems are your looking to support / manage ?
    – JJ01
    May 30, 2009 at 2:57
  • See above, I expanded on the question.
    – Laz
    Jun 4, 2009 at 5:26

13 Answers 13

6
votes

FreeIPA is one project that aims to replicate much of the functionality provided by Active Directory.

www.freeipa.org

2
  • This project looks interesting. Thank you. Are there any known production deployments?
    – Laz
    Jun 4, 2009 at 5:22
  • 1
    FreeIPA is the upstream project for Redhat IPA, which is now bundled in RHEL 6.2. There are plenty of production implementations of Redhat's IPA, if you need specific references, Redhat can likely provide them to you. The RHEL 6.2 package names for IPA are ipa-*
    – Doug
    Jan 18, 2012 at 18:33
4
votes

Samba can do some of the things that AD can, but I'm not sure I'd call it a full-blown alternative. Take a look at this Samba intro to see if it will suit your needs.

1
  • 1
    Samba 4 is where they're targeting the AD features, IIRC.
    – gbjbaanb
    Sep 6, 2010 at 9:57
3
votes

I use GoSa as my AD server :

GOsa² provides a powerful GPL'ed framework for managing accounts and systems in LDAP databases. Using GOsa² allows system administrators to easily manage users and groups, fat and thin clients, applications, phones and faxes, mail distribution lists and many other parameters. In conjunction with FAI (Fully Automatic Installation), GOsa² allows the highly automated installation of preconfigured systems. GOsa² therefore provides a single, LDAP-based point of administration for large and small environments, thus making the administration of users and systems and all related parameters manageable and easy.

More info on https://oss.gonicus.de/labs/gosa/

1
  • 1
    Looks like fun, though I'm a bit annoyed at a public site forcing the use of a (by default) non-trusted certificate for browsing the interesting parts ^^ Jun 4, 2009 at 8:59
2
votes

There is no open-source alternative that is even close to the functionality of Active Directory, as of 2009 anyway.

As MrDenny commented on your question - if you need all that, just use Active Directory, assuming you are supporting Windows clients.

2
votes

I think you could have a look at open-source Apache Directory LDAP v3 compliant server http://directory.apache.org

1
  • Oh yes ApacheDS is cool, it even supports NTP, DNS and DHCP serving.
    – eckes
    Jun 19, 2011 at 11:49
2
votes

If you are taking about Windows systems, I dont think there is any framework which is complete. In the Unix world some projects try to cover most of it by use of LDAP, NIS, PAM, NFS/AFS-trees, and some provisioning tools.

Look into Project Athena and Andrew for example.

Some projects like OpenSSO are going to support some of the policy aspects, but optimized for applications.

5
  • You probably can't post links because you don't have enough reputation yet. It's an anti-spammer measure.
    – Neobyte
    May 28, 2009 at 1:52
  • Yes I know, still annoying. Especially since I migrated my profie from Stackoverflow (which somehow did not work).
    – eckes
    May 28, 2009 at 1:54
  • Is there a place where we can provide feedback in an open forum? Because this majorly bugged me too.
    – Ehtyar
    Jun 4, 2009 at 6:05
  • You can provide feedback at serverfault.uservoice.com/pages/17382-general. The profile migration problem is currently in the top 4. Jun 4, 2009 at 7:14
  • You can also provide feedback at meta.stackoverflow.com.
    – Laz
    Jul 18, 2009 at 22:14
1
vote

As it was not mentioned yet, would 389 Directory Server be an alternative?

0
votes

There is no open-source alternative that can do all that. Samba can do a useful subset. Why are you asking?

0
votes

Samba 4, which is still beta, aims to be a strong alternative to AD.

1
  • When it is finished - in 2 years time... Mar 28, 2010 at 8:16
0
votes

If you're looking for something in the SOHO arena, then "SME Server" may do the trick.

http://wiki.contribs.org

I recently found it and have been playing with it on a test box. It seems pretty solid.

It will take care of all the normal stuff; file/print sharing, web, email and NAT.

It will also act as an old NT style PDC.

A nice review can be found here http://www.theregister.co.uk/2010/11/17/review_sme_server/

0
votes

LDAP will provide you with an active directory alternative, however there is not currently an alternative for Group Policy that I've found. I know someone else had said that opensso will in the future, and I've heard the same thing about Samba. Like I said though currently there is not a Group Policy replacement. If you find one though don't hesitate to share.

1
  • LDAP is a protocol, and one that Active Directory utilizes. Are you referring to OpenLDAP? You are right however, that Group Policy is one of the main reasons why you would want to use AD.
    – HostBits
    Jul 29, 2011 at 14:37
-1
votes

The LDS (Lightweight Directory Service) service in Server 2008 is basically the same replication engine that AD uses and you can setup users and groups inside the instance for authentication and authorization purposes. Just add it as a role from server manager after you install the OS.

3
  • Isnt this also called ADAM, a LDAP Server in Windows, not associated with AD?
    – eckes
    Jun 19, 2011 at 11:46
  • It was called ADAM prior to Server 2008. It is not AD, but uses many of the same underlying architecture that AD does. Here is a link to the overview - technet.microsoft.com/en-us/library/cc755080(v=ws.10).aspx
    – BoxerBucks
    Jun 20, 2011 at 19:58
  • 1
    AD LDS does not fit here. It can NOT support the features that are requested by the OP. from the link you shared:"In addition, AD LDS does not support domains and forests, Group Policy, or global catalogs."
    – HostBits
    Jul 29, 2011 at 14:39
-1
votes

Have you looked at Resara Server? Its an open source Active Directory PDC and file server based on samba4. http://www.resara.org

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .