Unfinished Business Part 2: Closing the Circle

Listen Print Discuss

Unfinished Business Part 2: Closing the Circle
Pages: 1, 2

The big win here is that the homogeneity of Windows allows this to work as an integrated system that can be set up and managed using one set of tools.

Compare this to UNIX and Linux environments, where login and authentication information can come from:

Local files (/etc/passwd, /etc/group) and their shadows
NIS files (/var/yp)
LDAP
NIS encapsulated in LDAP
Databases (PostgreSQL, MySQL, etc.)
Third-party enterprise directories (though none are generally shipped with major Linux distributions)

Authorization and access-control information can come from:

File system permissions
Kerberos (only for a very small range of objects unless you've done a lot of work)
Third-party enterprise directories (though none are generally shipped with major Linux distributions)
Homegrown authorization systems

Access control lists are not yet generally/widely implemented, except on experimental platforms such as the NSA's SELinux or via homegrown ACL-like systems.

User, group, and organizational policies are not yet implemented.

Host information (IP addresses, resource records, etc.) can come from:

Local files (/etc/hosts)
BIND

Systems management information can come from:

DNS (Resource Records, SNMP HINFO data, etc.)
External SNMP management systems

And so on ...

What's Missing?

What's missing from this picture is, to hearken back to the XWindow team's observation, a religion. Linux and UNIX have several tools and processes that may be applied (policy) but almost none that must be applied (religion). In order to both play in and compete in the enterprise directory space, the Linux/UNIX community needs to come up with three things:

A unified set of PAM modules that provide the glue so that workstations and servers can fully operate with Active Directory without the use of third-party products. Right now, most Linux distributions ship with the ability to get login information from an LDAP directory, but login data only accounts for a small part of AD's available metadata and resource and access controls. Adding more access modules that allow Linux to have more complete native access to AD will get it on more desktops and more servers in sites that are right now stuck with Windows systems.
Changes to glibc and the kernel that enforce compartmentalized security and mandatory access controls. I believe that some of these features will be part of the 2.6 kernel, but a really complete implementation can, again, be seen in the NSA's SELinux.
A unified set of metadata and services that map directly to those supported by Active Directory so that the open source community can develop and deploy a native enterprise directory service on the scale of Active Directory.

In order to meet AD on its own turf (so that Linux can seamlessly integrate today) and do what AD does, but do it better and more cost-effectively, all of these services must be able to be driven by LDAP and secured through Kerberos.

The most interesting part of this story is that 95% of the hard work has already been done! Microsoft didn't invent totally new LDAP schemas to make Active Directory as comprehensive as it is &mdash as usual, they embraced and extended the work of others. LDAP schemas already exist, and are publicly available to cover:

Contact management: The InetOrgPerson schema
IP Addresses, Users, Server/Workstation Info: The NIS schema
Kerberos tickets: IETF Kerberos KDC schema

Of course, Microsoft's own schemas are available for perusal on any Active Directory server (or, if you happen to have a Macintosh OS X box, look in /etc/openldap, for all of Microsoft's schemas are there). Microsoft's schemas are interesting in that they allow us to determine where they have deviated from the published standards (notably in ACL information in Kerberos extensions, which was the point of some heated debate back in 1998-1999).

Finally, we (the Linux community, in particular) tend to think that a lot of what we're doing is new, but the MIT Athena project had done a lot of this way back in the late '80s and early '90s. They did it across multiple versions of UNIX (AIX, Ultrix, SunOS, and several others).

Where Do We Go From Here?

There are two directions that Linux and UNIX must go in simultaneously in order to get up to speed in this important area of integration:

At the Workstation Level

Take the ACL code and other security hooks from the NSA's Security Enhanced Linux (SELinux) and use them as the platform into which PAM modules can be used to tie Linux into AD (and eventually a native Linux directory). SELinux enforces MACs (Mandatory Access Controls) in the system — some people will bridle at the thought of adding such potentially draconian security into what is a very friendly OS, but the addition of such security controls will only help the community write better software that only uses a privilege where it's needed, and not just because someone didn't take the time to code a correct solution. It will also help cut down on potential security breaches down the road.

At the Enterprise Level

First and foremost, Linux vendors need to ship fully configured LDAP and Kerberos servers with their distributions with full-fledged database back ends, not just a DBM-style library, as is currently the case. The single hardest part of either of these systems is the setup. Wizards need to be provided (the existing ones in most distributions are dreadfully inadequate) that make the configuration of parameters simple and activate available schemas without forcing the administrator to become either an expert in LDAP or Kerberos.

Next, from the perspective of making a Linux enterprise directory AD compatible, is frankly to dissect Active Directory's schema and implement the proprietary bits under Linux. When Microsoft does such things they call it "embrace and extend" because they usually take an open standard and add some proprietary extension to make it non-portable and lock in their customers, as they did with their extensions to Kerberos. I would suggest we take a page from their playbook but call it "enhance and open." As long as this is not done with internal Microsoft documents that are subject to NDAs, this should not be a problem. (Hint: the information was reverse-engineered long ago and is readily available).

LDAP and Active Directory Tools/Notes:

There are several tools already out there that make setting up and administering LDAP a bit easier. Here are some of the most complete:

LDAP Admin Tools

Active Directory and LDAP Implementation Notes

David HM Spector is President & CEO of Really Fast Systems, LLC, an infrastructure consulting and product development company based in New York

Return to the Linux DevCenter.

Thoughts? Share them here!
You must be logged in to the O'Reilly Network to post a talkback.

Showing messages 1 through 32 of 32.

What people (who are on Soap-box's here) are failing to understand.....
2004-03-23 12:38:39 vikingamerican [Reply | View]

Is that this is not about which solution is better. The Article is about the reality of many medium to small shops with small IT departments.... which is that MS WIN2K/2K3 server is being used for the primary big buck expenditure for establishing an Infrastructure in which there is minimal training needed regarding implementation of a solution that provides one stop shopping for said solution. If one looks at many shops, they will see that "out of the box", MS is easier to implement (please note that I didn't mention that they were using correct security or deployment procedures in many places). When they have the basics such as authentication, file/print services, etc..... then the budget gets thinner. For instance, how many people would go with Q-mail if there was an plug-in to tie in with A/D vs. using Open Ldap? Sure one can use "Insight" (which provides the only tool to tie in the email server with A/D). But we are talking about using Linux on the backend to tie in with A/D.

E-Directory costs money also (and plays nicer with Linux), however, I suspect that it will see less and less market share given it's T.C.O. vs. Microsoft's (and mindshare is almost non-existent within many I.T. shops). Surely people can see past what is better and will acknowledge the reality which is that Microsoft has won the Directory Services battle at many companies. Given that, having the option to tie in low cost solutions such as Q-mail with Active Directory regarding Address lookups and authentication will be the first step towards keeping Exchange, SQL, and other Microsoft offerings out of the enterprise. I am a Microsoft support engineer for my company and even I am sick and tired of the Software Assurance / Licensing costs associated with Microsoft's products. But Microsoft purposely makes Server Software cheap and easy to implement, and goes in for the kill regarding exchange, sql, IIS, etc.

How about the Linux Pundits find religion as the author states and realize that Microsoft will almost always be tied in regarding providing A/D (and that it would be best to either provide an Open Source solution or develop products that tie in with A/D).

There is a saying..... "In I.T., there is no right way to do it.... only the way that meets expectations of the user community and management. There is no such thing as I.T. Nirvana where everyone does things the way they should be done." Best for some people to get off their polyana soapbox and accept reality. And that is where this author was trying to take this article.

eDirectory article
2003-09-29 16:29:53 anonymous2 [Reply | View]

Out of curiousity, is there an ETA for the eDirectory article?

Thanks

eDirectory article
2003-10-28 17:02:06 anonymous2 [Reply | View]

Is there an ETA yet for the new article?

Thank you.

Good article...
2003-09-09 06:16:15 anonymous2 [Reply | View]

David Spector's articles hit a number of good points. Some of the comments about eDirectory, Novell, and AD technical details notwithstanding, I feel that his main points are completely valid. There is no standard, out-of-the box Open Source "domain controller." Everyone who wants a network-based authentication and directory service for their Linux/*BSD machines has to "roll their own" custom system....a royal pain in the behind that will prevent enterprises from adopting Open Source.

I am in the midst of a Kerb5/OpenLDAP rollout. What a pain! There is NO reason that Red Hat, SuSE, Debian, Mandrake, and others could not have a ready-to-go LDAP/Kerb5 solution right out of the box, with CLI and GUI admin tools. If they did, it would be THAT much easier to migrate away from Microsoft.

A good, interoperable, secure, Open Source directory/authentication system for Linux is not just a "missing piece", its a gaping hole!

"Roll your own" and eDirectory may work in some environments, but it won't capture the medium and small enterprises.

- Van

Thoughtful article(s), and important
2003-08-08 06:31:10 rfoard [Reply | View]

The flaming of the author, his knowledge and research not withstanding, this article makes an excellent point. The various linux distributions world would benefit from standard, administrator friendly, directory services.

Thoughtful article(s), and important
2003-08-13 13:57:57 anonymous2 [Reply | View]

"various linux distributions world would benefit from standard, administrator friendly, directory services."

Haven't you read the jist of the replies? There's alread one available.

Thoughtful article(s), and important
2003-08-13 16:29:33 anonymous2 [Reply | View]

"There's alread one available."

Sorry..."there's already one available."

HUH???
2003-07-22 11:25:18 anonymous2 [Reply | View]

"But a majority of medium and large enterprises have switched over to Active Directory because it's not possible to run a large Windows shop without it."

In the interests of avoiding redundancy I won't go into dirXML and NDS's hetrogeneous support and features previous posters have mentioned.

I'll assume you're talking about desktop management and populating the directory. Nope, that can't be it, ZenWorks from Novell does that and works with eDIR (Zen will run on Linux later this year).

I'm sorry, I'm confused. Not possible? I'm sorry but you're going to have to do better then that.

AD does NOT use Kerberos
2003-07-19 10:29:04 anonymous2 [Reply | View]

Microsoft has extended the Kerberos standard, it's not compatible with other Kerberos authentication systems. This has been known for years and if the author had done any research before he published his article, or if the editor had validated this article, it would never have been published.

Here, educate yourself:
http://www.nwfusion.com/news/2000/0511kerberos.html

Please Read the Article
2003-07-19 10:46:44 chromatic | [Reply | View]

David brings this up in "What's Missing?"

So why...
2003-07-14 17:51:58 anonymous2 [Reply | View]

I've tried to post about one of David's books, but the posts keep getting deleted?

Why?

Dave

Off-Topic
2003-07-14 18:36:54 chromatic | [Reply | View]

I delete off topic and impolite posts. Questions and comments about the article are welcome. Personal disagreements with the author are not.

Off-Topic
2003-07-15 06:03:55 anonymous2 [Reply | View]

"I delete off topic and impolite posts. Questions and comments about the article are welcome. Personal disagreements with the author are not."

This is not off-topic, impolite or due to a "personal" disagreement.

The reference to his other work is not off-topic because it reflects that this is not the first time the author's expertise has been questioned through reader response to his work. Many of the statements in these two articles are blatantly false and should not attempted to be passed along as anything else.

I guess a new question comes to mind...how many times will oreillynet.com support articles/books from a particular author whose expertise is continually questioned by readers before it is suggested that he be a little more professional?

Off-Topic
2003-07-15 09:15:49 chromatic | [Reply | View]

These two articles aren't really about Active Directory or eDirectory. They're about the challenges people face while migrating large business networks to Linux. That said, I've asked David to explore eDirectory in his next article. If it solves the problems he brings up in these two articles, it's well-worth an article.

As to questioning an author's research or conclusions, that's one reason we have talkbacks enabled. That goes for any author. If you have hard numbers as to deployment rates of one product versus the other, by all means please post them -- but I'm going to need something stronger than opinion.

Off-Topic
2003-07-16 16:50:53 anonymous2 [Reply | View]

"That said, I've asked David to explore eDirectory in his next article"

His first two articles on Enterprise Directory Services contained numerous generalizations, assumptions and technical inaccuracies. How is he going to learn and then effectively evaluate something that is obviously foreign to him?

Is the article due before or after he corrects his mistakes (or backs up his assumptions) in these first two articles? You took to task your *readers* to provide backup for their comments, but you don't hold an author with a negative track record to the same standards?

I would suggest that you get an experienced CDE to write the article. It only seems appropriate to have someone who is already integrating Netware, Windows and Linux servers within their environment to write the article as opposed to someone who wrote an article on "Enterprise Directory Services and Linux" when they were supposed to write about the "challenges" that a company faces when integrating Linux.

Off-Topic
2003-07-16 17:45:34 chromatic | [Reply | View]

I don't care to discuss my business or editorial dealings with an author with anyone besides the author or in public. If David wishes to respond, he's welcome to do so. If you have general questions about my editorial policies, please feel free to send me an e-mail.

David's agreed to tackle eDirectory and I'm looking forward to that article. At that point, if you'd like to write a rebuttal, please send me an e-mail and we can discuss the process.

I do appreciate your concerns about the facts of these two articles. Part of the blame rests with me -- I don't have the time at the moment to give every article the attention it deserves. We've done peer review of articles in the past, though it's mostly been instigated by authors themselves. I'll bring up the idea in our next editorial meeting.

Reading through some of the links provided in other messages, I don't reach the same conclusions you do. There may be a big perceptual issue here. While Novell's been doing fine, fine work for years, Microsoft's the 800-pound gorilla and as NT 4.0 finally slouches off into the sunset, the upgrade path from NT domains seems to point to AD. Whether that's fair or right is not a question I want to answer.

David HM Spector - follow up
2005-06-12 14:25:44 tom_sawyer70 [Reply | View]

"David's agreed to tackle eDirectory and I'm looking forward to that article."

So...it's been a couple of *years* now. Is David going to tackle the article?

It's still posted on his site that he's an active "expert" for this site...http://www.zeitgeist.com/, but curiously, he has never posted a follow up. Is this the type of technical drivel you accept?

Off-Topic
2003-07-19 10:21:23 anonymous2 [Reply | View]

"Microsoft's the 800-pound gorilla and as NT 4.0 finally slouches off into the sunset, the upgrade path from NT domains seems to point to AD.'

Then you would be incorrect in your assumptions as much as the author of the "article" was in his technical review of directory services.

As someone who has migrated from Windows NT Domain system to Windows 2000, I can tell you that the NT world may be moving (albeit, slowly) to Windows 200x, it is most certainly not making the transition from the NT Domain model to ActiveDirectory at the same rate. AD still lags a great deal behind in the migration path and many Windows-shops are still using the NT Domain model instead.

Part of your perception that is flawed is that Windows 2000 requires AD. This is far from the truth. Indeed, Windows 2000 will happily function using a Windows NT Server as a Primary Domain Controller and that Windows 2000 server will be content as a member server within that NT Domain.

In other words, just because you have Microsoft's latest server OS does not automatically mean you must use Microsoft "directory" service to run it.

"Whether that's fair or right is not a question I want to answer."

Then you should not have made the statement if you are not willing (or more rightly so, incapable) to back it up.

Off-Topic
2003-07-17 17:02:46 anonymous2 [Reply | View]

"David's agreed to tackle eDirectory and I'm looking forward to that article. At that point, if you'd like to write a rebuttal, please send me an e-mail and we can discuss the process."

I'm bored with this argument, so let's simply agree to disagree at this point.

I simply don't care for being *asked* to supply responses to an article, to point out discrepancies and then to be held to a higher standard than your so-called "expert" who can seemingly state whatever he pleases without such scrutiny. I'm sure the other posters do not either.

I, too, am anxious for the eDirectory article and we can go from there. Maybe the third time will be a charm. Heck, I'm not even really "into" Linux, and while I came here to read the article, I initially thought that I could use the site as a reference when I decide to take the plunge. After reading the article, though, not only did my perception of the site change, but I took exception to someone passing off the MS shill routine and voiced my opinion...which is based on experience and a network of colleague administrators/managers.

I don't have anything personal against you or David and I hope to see something a little more tangible that we all can use in the next article.

Dave

Off-Topic
2003-07-16 19:46:32 anonymous2 [Reply | View]

You don't have to air your policies here, but after repeated issues with an author, you have to wonder how long your reputation can absorb such issues.

"Part of the blame rests with me -- I don't have the time at the moment to give every article the attention it deserves. "

You shouldn't have to...that's why you should have authors with credibility (see above).

"Reading through some of the links provided in other messages, I don't reach the same conclusions you do. There may be a big perceptual issue here. While Novell's been doing fine, fine work for years, Microsoft's the 800-pound gorilla and as NT 4.0 finally slouches off into the sunset, the upgrade path from NT domains seems to point to AD. Whether that's fair or right is not a question I want to answer."

It's not a question of what is "right." We all know that MS is a convicted monopolist and would love the public to "perceive" that everyone is moving to AD.

As for the perception of Novell eDirectory, I guess a question I would raise is...what more would you like to see? You had an author devote two articles to issues dealing with AD's lack of functionality with Linux integration and he made generalizations about its market share...at the same time, you've had multiple replies that pertain to how people have already implemented multi-platform solutions with eDirectory. You also had someone post reference links to large company implementations. Do you think those companies are all one platform?

NT upgrades may "seem to point" to AD, but the issues with compatibility with multi-platform systems (while techically incorrect, you may refer to David's articles for more on this subject as it pertains to Linux) deem it to be improbable.

In addition, there were posted references to independent reports regarding the slow adoption of AD.

The only "perception" issue that I have seen in visiting this site is a continual denial of the prominence of eDirectory.

If nothing else, MS has repeatedly pushed the support date for NT4 back, which reflects that the majority of their customers do not want to rewrite their apps for W2k, and now W2003, much less attempt to implement AD.

Dave

Off-Topic
2003-07-15 18:31:09 anonymous2 [Reply | View]

'These two articles aren't really about Active Directory or eDirectory. They're about the challenges people face while migrating large business networks to Linux.'

That is blatently false. The first article was nothing BUT praise for ActiveDirectory and both articles concentrated specifically on ActiveDirectory and how "Linux can't run AD". At best, it only began to scratch the surface of the Linux authentication process and a few select services that Linux offers that are requirements of an ActiveDirectory installation.

If this was a true comparison of migrating from Microsoft Windows to Linux, then the author should have explored more than just the "directory services" component of both OS's. The author neglected to mention critical components such as automatic software updating, security protocols and services, web services, etc. As such, this was strictly an "AD vs. LDAP or Lack of AD on Linux" article.

'That said, I've asked David to explore eDirectory in his next article. If it solves the problems he brings up in these two articles, it's well-worth an article.'

Not attempting to be insulting, I doubt David could do it justice. There are already serious technical errors in his articles on AD and he apparently doesn't understand eDirectory. Do you honestly expect an unbiased and educated review of Novell eDirectory? I, for one, do not. I do not believe the author would write one in as much so as I do not believe he is capable of writing one.

But, I will admit, I would enjoy watching him fall flat on his face in his attempt to write such an article.

At that point, could we call upon his termination for lack of credible journalism?

Off-Topic
2003-07-15 14:34:08 anonymous2 [Reply | View]

Chromatic...
"that's one reason we have talkbacks enabled."

So then why strip out a post reflecting a precedent?

"If you have hard numbers as to deployment rates of one product versus the other, by all means please post them -- but I'm going to need something stronger than opinion."

Well, I guess that means that the author, the person who supposedly did research, does not have to back up his claims?

So, let me see if I can come up with eDirectory implementations...that is, in addition to the other people who have posted...

"BASF uses eDirectory to simplify administration of more than 40,000 users."
http://www.novell.com/success/basf.html

British Telecom..."The solution is powered by Novell SecureLogin and Novell eDirectory�."
http://www.novell.com/news/press/archive/2002/05/pr02041.html

Lufthansa...
"As part of the contract, Novell's directory and network services will be used to consolidate user data for approximately 70,000 employees, and create a secure and structured access to the company Intranet."
http://www.novell.com/news/press/archive/2002/01/pr02009.html
http://www.infosecuritymag.com/2003/may/lufthansaid.shtml
http://www.vnunet.com/News/1140320

French Tax Authority...
"Novell, Inc.�, a leader in eBusiness solutions and Net services software, today made public details of its largest European eGovernment project; a directory solution for the Direction G�n�rale des Imp�ts (DGI), the French Tax Authority, that will be used by 35 million French taxpayers"
http://www.novell.com/news/press/archive/2001/12/pr01117.html

"Novell initially estimated that they would attract 40 to 50 customers over the entire life of the promotion. They guessed wrong. In the first month, they had 1,700 customers sign up."
http://www.integratedmar.com/ECL.cfm?item=DLY121102-03

Although they claim 1.4 billion licenses, they state they have "734 million active eDirectory user licenses"
http://www.novell.com/products/edirectory/

As for the adoption of (In)active Directory...

"Following slow adoption of Active Directory after its release as part of Windows 2000 three years ago"
http://www.eweek.com/article2/0,3959,667380,00.asp

"the slow adoption of AD has been a frustration for Microsoft. "
http://techupdate.zdnet.com/techupdate/stories/main/0,14179,2895694,00.html

You can't really run AD on an old platform...now can you...

"A recent ENT survey of 800 enterprise Windows sites finds that 64 percent still run Windows NT 4.0"
http://www.entmag.com/news/article.asp?EditorialsID=5723

"According to some industry estimates, between 35 and 45 percent of Windows server customers still run Windows NT 4.0,"
http://www.internetnews.com/ent-news/article.php/2196381

Enough?

Off-Topic
2003-07-16 16:45:18 anonymous2 [Reply | View]

Almost forgot...

"Internet company Yahoo tightened its relationship with software maker Novell this week, agreeing to promote the company's directory-services technology as the default in its corporate portal service."
http://news.com.com/2100-1023-273037.html

How about website development with eDirectory on Solaris?
http://developer.novell.com/research/devnotes/2000/february/03/dpv.htm

And from today...
"Novell eDirectory is by far the more mature, established directory service on the market," said Rod Carney, manager of IT infrastructure at Huntington National Bank. "Novell consultants established an LDAP authentication using eDirectory and began integrating applications within six weeks, more than a month ahead of schedule."
http://www.novell.com/success/huntington.html

On topic...
2003-07-15 14:03:42 anonymous2 [Reply | View]

"These two articles aren't really about Active Directory or eDirectory. They're about the challenges people face while migrating large business networks to Linux."

To pick up the conversation...in the first sentence of this article, David states "the first part of this discussion about Enterprise Directory Services and Linux," but the discussion only centers around AD. I guess that is a "challenge"...to try to get something that doesn't work to work. Maybe someone could follow up with "the challenges of getting a Linux box to product a BSOD"...MS *definitely* has the "de facto" monopolistic market share there? Heck, Linux doesn't even have a "screen of death," much less a *blue* one. ;-)

On the other hand, if this is about "Enterprise Directory Services," then why wouldn't he discuss Novell or Sun products (among others) in addition to AD?

On topic...
2003-07-15 14:04:27 anonymous2 [Reply | View]

oops...should have been "to produce a BSOD".

Name them...
2003-07-12 10:51:17 anonymous2 [Reply | View]

"But a majority of medium and large enterprises have switched over to Active Directory because it's not possible to run a large Windows shop without it."

Last time I checked, many Fortune 1000 companies were still eDirectory (or even NDS) shops or remained NT Domain shops.

We have Windows 2000 but stuck with the NT Domain model. It wasn't important anyways as we have Novell's directory service in play and use Novell Account Manager to manage both NDS/eDirectory and the NT Domain model. NAM will also manage UNIX PAM and Windows ActiveDirectory services.

Using other Novell tools such as DirXML we can control just about anything. Microsoft's equivalent is more of an "uberdirectory" than a metadirectory. In that, the data is controlled and stored in AD rather than sync'd as in eDirectory with the other services. This means that while eDirectory remains lean and mean, AD becomes bloated and prone to corruption.

btw: France needed a directory service (yes, the entire country) - and like many other cities across the world (and in the U.S.) they choose Novell eDirectory - 35 MILLION nodes of it. Show me ONE single company running Microsoft AD with a 35 MILLION node Domain Forrest.

Wait, you can't - because it doesn't exist.

You, sir (and I use the term lightly) are nothing more than a Microsoft shill. You have no intention of comparing directory services, you simply want to push the Microsoft mantra.

You are nothing more than another Mindless Minion of Microsoft and I dare you to prove me wrong.

oh, you can control a Windows 2000 AD install with eDirectory and NAM or DirXML, negating the need to migrate away from Novell's product and use AD exclusively - that alone disproves your statement I quoted above.

Question
2003-07-12 10:39:23 anonymous2 [Reply | View]

You now mention Novell eDirectory, but are still harping on the Microsoft ActiveDirectory vs. UNIX authentication protocols. You don't compare Microsoft AD with Novell eDirectory at all...

Obviously this is a weak ploy to do a Microsoft vs. Linux/UNIX argument and put it into print. But in doing so, you are doing yourself and your readers a diservice by ignoring a true directory service IF the intent was to do a directory service comparison.

Or are you simply afraid that in comparing Novell eDirectory to Microsoft ActiveDirectory, you will find out just how much the Microsoft product pales in comparison?

Be afraid, be very afraid.

Boy - still wrong
2003-07-12 10:39:16 anonymous2 [Reply | View]

"Several people took me to task for failing to give credit to Novell's NDS package which, to be fair, is the granddaddy of modern commercial enterprise directory services."

Actually, that would be Banyan Vines - I see you are still not doing any research.

I also take issue with you reference to eDirectory (NDS isn't made anymore) being called "granddaddy" - it's a poor attempt to insult a mature and stable directory service.

Now, some downers regarding AD:

1) need to do some repairs on AD? Drop your server and reboot into a special repair mode. Of course, this kicks the users off the server and shuts down all the services.

Need to do the same thing in eDirectory? Run DSREPAIR while the server and services are still running and the users are logged in.

2) AD is NOT a directory service. Why?

a) security is not designated at the container (.O or .OU) level. You still need to use Groups (ala Domains) to delegate rights.

b) file/folder permissions are not stored in the directory but at the server itself.

c) you still cannot have duplicate user objects in the heirarchy. Proof:

i) create a single domain tree
ii) create an organization (.O=ACME)
iii) create two organizational units (.OU=Marketing, .OU=Sales)
iiii) create a JDOE account under Marketing

now attempt to create a JDOE account under Sales.

you will find you cannot do it. Why? Because the Domain "tree" is still a flat file database.

even though .JDoe.Marketing.ACME and .JDoe.Sales.ACME should be completely unique objects with completely unique names (as their fully distinguished names indicate) - Microsoft AD prevents their creation.

Which means the only way around this limitation is to create multiple Domain Trees in the Domain Forest.

Correct me if I am wrong, but I believe you can have only one replica of a Domain Tree per server - this would force the installation of multiple Windows servers to provide adequate replication. Not an easy or cheap task for small/medium businesses.

AD also requires more resources. A eDirectory database with x number of users could eat up 9MB of disk space. That same AD database with the exact same number of users eats up 90MB of disk space. That means more data, more data to replicate, fatter data pipes to allow replication.

Then you have the whole Microsoft/security issues they've never been able to squash. I especially love the AD vulnerability that allowed reqular users to give themselves Admin rights or change the Admin password...

nifty that AD. Just nifty.

Now you understand why it's an eDirectory world, and always will be.

Boy - still wrong
2003-07-22 17:17:24 anonymous2 [Reply | View]

"c) you still cannot have duplicate user objects in the heirarchy. Proof:"

Just be glad AD isn't a national phonebook! Or even a company phonebook.

Or a small company.

Or a phonebook for a sole proprietorship!

Hah! See, it works!

:-P

You still seem to be avoiding discussions about eDirectory
2003-07-11 22:03:07 anonymous2 [Reply | View]

Ok, now your next article should look deeper into eDirectory as an enterprise directory. How it can pull your desperate network together. I don't care what you say, the larger the network the harder it is to have a completely homogeneous network. There will still be Unix, MAC, Main Frames, Oracle, SAP....

eDirectory can manage all this from a central directory and AD can't. I think that was your point.

So now that you have plugged MS. Take a look at what eDirectory can do. It has matured so much in the past 2 years. If you haven't looked at it, do it.

Do some research then come back and talk about how your can manage your entire enterprise with one directory. The scalability far surpasses AD. Look at partitioning, replication, scalability, security, compatibility and efficiency.

Last I looked at AD, I couldn't put the same common name in two separate contexts. How does that work in a large enterprise. I have seem users with the same common name in small networks.

I'm not knocking AD, I just think it still has a lot of work ahead of it. eDirectory on the other hand is very mature and ready for huge deployments (much larger than AD). It also doesn't require a homogeneous network.

You can say what you like about having a homogeneous network, but I look carefully at my investments and I don't want anything that will lock me into one vendor. I something that will be flexible if the market turns (and we are seeing a lot of that lately). Any responsible IT manager will look into cost, flexibility and scalablity. Microsoft's homogeneous networks don't give me any of those:-)

Just my opinions

AD and SQL backend?
2003-07-09 10:47:25 anonymous2 [Reply | View]

Is the SQL backend something new to 2003? M$ seems to like using the JET(fancy name for an access db) backend for everything from DCHP to Exchange. The last I understood Win2000 was still using JET to store everything but I haven't read anything stating it was otherwise in Win2003, except in Exchange 2003.

jerky

AD and SQL backend?
2003-07-15 18:32:31 anonymous2 [Reply | View]

No, AD still uses JET - the author didn't do his homework.