Ask HN: Is ActiveDirectory an Embrace, Extend, Extinguish of LDAP?

Re:Ask HN: Is ActiveDirectory an Embrace, Extend, Extinguish... by bjourne on Friday November 29, 2019 @07:25PM (#21667659)

LDAP and AD aren't equivalent technologies. LDAP provides "directory services" meaning (practically speaking) usernames, passwords and security policies. AD provides that and much more. For example, AD lets you share folders and manage users, something LDAP doesn't support. So you have to combine LDAP with other protocols.

Many many years ago I had the displeasure of being in charge of an AD to OpenLDAP+NFS migration for a mid-sized company. I was put in charge after an intern had spent months trying but failing to come up with a migration plan. I can tell you it wasn't fun. Especially the weird configuration files and stupid Perl scripts I had to use to communicate with OpenLDAP. I don't remember the details, but there was a lot of character encoding problems (åäö) and places where whitespace was significant in command line arguments.

It made me appreciate AD because in comparison configuring that is a breeze. I'm not much a MS fan but AD is imho a solid product.

[ Parent | on HN ]

Re:Ask HN: Is ActiveDirectory an Embrace, Extend, Extinguish... by stephenr on Saturday November 30, 2019 @01:40PM (#21671464)

AD let’s you provision file system/share permissions. It isn’t a file share in and of itself.

Just like in the AD world, other tools allow you to configure them either partly or fully via ldap.

I’m not sure what you mean that ldap doesn’t let you “manage users”. That’s literally the most common use case for it.

I don’t know why you felt forced to use Perl. The primary interface of any ldap compliant directory is just ldap, which has bindings in practically every language, and if you want to do bulk operations, you’d probably use LDIF.

Blaming ldap for you using Perl is like saying “I hate the web it requires you to write java”.

[ Parent | on HN ]

Re:Ask HN: Is ActiveDirectory an Embrace, Extend, Extinguish... by bjourne on Monday December 09, 2019 @11:49PM (#21749691)

The LDAP protocol doesn't contain features required for properly managing users. For example, to set password expiration dates, control password strengths or to allow autonomous password recovery. Such features are instead provided in extension modules, if at all.

10-15 years ago when I dabbled with LDAP, the only bindings for OpenLDAP was written in Perl. Glad to hear that the situation is better now.

[ Parent | on HN ]

Re:Ask HN: Is ActiveDirectory an Embrace, Extend, Extinguish... by mean_gene_1976 on Friday November 29, 2019 @10:47PM (#21668389)

Me and perl dont mesh either.

[ Parent | on HN ]