On Mon, 2005-07-18 at 08:54 +0800, Feizhou wrote:
Well, MS made extensions to its LDAP implementation by giving it new RPC calls for its special MS Kerberos data did it not?
In a nutshell, yes you are correct in that Samba handles the "winlogon" process and other RPC services. I'm just saying there's a lot that Samba does not have to handle.
I think you keep mixing the fact that there _are_ other ways to manage Windows clients _other_ than with 100% emulated Windows RPC. If you want 100% full MS ADC DC emulation, it's going to be quite awhile.
Right, but you got me interested in whether an actual open source solution to native Windows MS-Kerberos account management exists when you say that Samba 3.0 could be an ADS DC.
To a point. You do _not_ have to have any MS ADS DC on your network to do a lot, trust me. The problem is that most people assume the only way. It's quite the opposite -- it's putting MS in charge, and that's something you want to avoid or segment.
and native MS account management on Unix?
By "native" -- what do you mean? You mean 100% MS schema in their LDAP? Again, that's going to be awhile.
Now the Samba team has their own, both CLI (net) and additional projects are out there. But that's still looking at it "narrow-mindedly."
Consider, for a moment, an entire Windows enterprise that relies on an open-backend, like NsDS, Sun One, etc...? Heck, even Novell eDirectory. Novell has a lot of management tools for Windows, some work pretty damn good too (like Xen).
But even that aside, you can do quite a bit with NsDS (or OpenLDAP), Samba 3.0's added schema and RPC functions, and SASL/Kerberos for the password store. But if you expect it to support all the nuiances and all the little schema that are in all sorts of MS services (like MS SQL, Exchange, etc...), that's going to be a _long_time_.
But don't think you have to have a native MS ADS DC to manage Windows clients -- not at all!