AD only works if all your clients are windows. In 2018, not all of them are. We're out of a monoculture now. Doing AD SSO on other platforms is a proper pain in the butt. For example when Microsoft deprecated some of the old protocols a few years back they broke RHEL entirely for 2 years.

Not sure there is another solution though. OAuth and various cloud logins etc isn't, yet.

> AD only works if all your clients are windows.

Uh, yeah, that's kinda my point. Outside of SV, pretty much every client is, and for this reason.

Are you saying that outside of Silicon Valley pretty much every client is Windows? Where do you live?

I work for a Fortune 100 company (not in SV, or even California) with 70,000 employees. At least 50% (it's probably higher) of computers here are Macs. When I go to a meeting, the table is a sea of Mac laptops with the occasional Windows laptop here and there. And these aren't meetings with developers, I'm talking about sales, business, training, etc. people.

That’s still extremely rare. Personal laptops are always up to personal preferences, but most organizations run on windows. At my employer, a university enrolling 50,000, everything is windows. If you wanted to request a new computer through the school to have access to shared directories, you can pick a dell desktop or one of two HP laptops. Macs are rare, and they are bought and forgot by IT. I’ve seen iMacs running leopard still; and they are all off of the intranet.

For my friends who do get macs from their workplace, it’s because they are 1 of just 20 employees and they don’t have anyone in IT, let alone a department or any policies.

One difference might be that almost nobody has a desktop computer. The vast majority of people use a laptop. But they are free to select from a menu of about 20 different laptops including Mac Book Airs and Mac Book Pros. Almost everyone also has a company supplied phone. Again, they have the a selection of about 20 phones to select from, including Android and iPhones. So the environment here is very heterogeneous.

This is increasingly not the case though.

Not every country people can enjoy a quality level to afford Apple computers, even with IT salaries.

Why do you immediately jump to the conclusion that the parent was referring to just Macs?

Because I have seldom worked in environments that allowed anything else as desktop.

UNIX derived OSes tend to be relegated to the server room, accessed remotely and live on their own network.

Fair. But I was commenting more on the environments that historically were served well by AD (offices) are growing in use of Apple computers.

[Citation Needed]

I can believe that this is a true statement inside the reality distortion bubble around SV, but here in the real world I'll need to see some evidence.

The problem is that you're assuming I'm in SV, I'm in a small Swedish city and I'm seeing our _very_ windows heavy company starting to adopt Apple computers.

And when I think of the companies I worked for in London they were also increasing the Apple quotient of desktop/laptop machines.

Yes, this is anecdatum but I really can't tell you how strongly integrated Windows is at my company and we're still seeing adoption of Apple computers.

Regardless of that, Sysadmins and Developers tend to get to choose their OS at most sensible companies. (Every company I've worked for, barring the current, has allowed Linux; most even encouraged it)

MICROSOFT went heterogeneous client for their AD. I'm sure others can.

>AD only works if all your clients are windows. In 2018, not all of them are. We're out of a monoculture now. Doing AD SSO on other platforms is a proper pain in the butt.

That's simply untrue. Every large org I work with has unified auth with ad and a secondary package like centrify. It's trivial to get working.

And that's ignoring all the linux appliances and embeded Linux flavors (think lights out management) that support AD out of the box.

While I think that's a good point, there are alternatives to AD at this point in time. Anyone using that as a crutch is just giving excuses for not wanting to update their infrastructure.

And those alternatives would be...?

MS is very slowly moving away from AD themselves to a "MDM" cloud-provisioning model more or less copied wholesale from what Apple did with iOS. They claim that binding machines and users to AD is optional these days, but the alternative workflow leaves a whooooole lotta gaps. Maybe in 5 years it will be a real alternative.

Plug: I work out JumpCloud, a directory as a service company.