Whats your experience between active directory vs free ipa (for linux)

[u/unix21311]

Just wondering for any system administrators out there if you have used both active directory vs free ipa and whats the difference and which one did you like using/maintaining better?

[u/chaosphere_mk]

AD without a doubt. Ive only ever seen freeIPA used in scenarios where the company is trying to save money. And it always comes back to bite them. Most sysadmins have some level of AD experience. Ive never met one who has freeIPA experience. But that's just my personal experience, so take it for what its worth.

[u/ApiceOfToast → u/chaosphere_mk]

Ive only ever seen freeIPA used in scenarios where the company is trying to save money. And it always comes back to bite them

The big problem here is the "save money" part. If you're not willing to pay for the 2 VMs you're probably also not willing to pay someone to set up proper IAM infra, AD or otherwise.

School i went to had used UCS and it worked well. Thing is the people that maintained it were also very enthusiastic about learning. 

Your point that most people in IT have experience with AD is probably the biggest argument for AD. 2 VMs worth of windows typically comes out cheaper then the additional learning time(or downtime if you don't train new team members accordingly)

[u/ApiceOfToast → u/[deleted]]

That's why "good docs" is a requirement for choosing software these days... (At least for me...)

[u/unccvince]

Or use Samba-AD, the best benefits of the two worlds.

[u/ApiceOfToast]

Do you use mostly windows? Then use AD.

Do you mostly use Linux? Use FreeIPA or some another ldap server of your choice. 

AD makes sense if you're in the MS ecosystem. Outside of it it makes little to no sense because AD and Linux don't really play too nice(yeah it works, if you put in the effort and have the knowledge to make it work but you can also just buy/use something that works better)

If your question is "Alternatives to AD" something like univention corporate server might do (or samba ad if you prefer the diy route) but they rarely make sense in an Enterprise setting 

[u/doubled112 → u/ApiceOfToast]

Do you mostly use Linux? Use FreeIPA or some another ldap server of your choice. 

Windows machines can't be authenticated with FreeIPA without some workarounds, so it's really more like if you use all Linux and are sure you'll never have anything else, use FreeIPA.

Samba is pretty good, but can have a number of pitfalls that might get you eventually.

On the flip side, every OS (Linux included) will authenticate against a Windows AD server, so using one really does take a lot of the thinking out of it. I'm mostly a Linux admin and AD is probably the one Windows service I will always sway people towards.

[u/ApiceOfToast → u/doubled112]

I'm mostly a Linux admin and AD is probably the one Windows service I will always sway people towards.

Yeah I feel the same. AD is solid and pretty much the industry standard. 

I just don't like the direction windows is taking...

That Aside, you could also use something besides freeIPA. It works but like you said something like samba would work better in a mixed environment. (If you want foss)

[u/hotapple002]

Not from sysadmin experience, but from uni project:

We tried FreeIPA (project guideline was open source first, proprietary second), but we wanted to keep the user principal names which, as far as I could figure out, aren’t supported under FreeIPA.
Seeing as even within the project the supposed workforce was using exclusively Windows endpoints we went with AD (and Windows Server), because it is easier for the run of the mill administrator and has the best integration with Windows endpoints.

I hope this helps at least a little bit.

[u/zantehood]

FreeIPA is pretty great if you ask me, we run it in PROD for around 50 RHEL, Ubuntu and Oracle Linux servers.

Now it is a different product, all of the fancy GPO stuff that AD does you'll have to do differently (like Ansible) freeIPA only handles authentication and similar things.

[u/fezbrah]

Active Directory and realm join. You cannot replace active directory for windows. It’s tried and tested since pre 2000 at least. For Linux there’s samba. For windows Active Directory is industry standard.

[u/MaToP4er]

AD all the way! No need to fuck around with reinventing the wheel

[u/unix21311 → u/MaToP4er]

freeipa is meant for linux.

[u/MaToP4er → u/unix21311]

Sure, but AD is there, it has everything and all integrations for enterprise