What LDAP implementation would you use?

http://stackoverflow.com/questions/663402/what-are-the-diffe...

OpenLDAP. But I don't want to derail into nits really - I'm looking at the broader question of "What offerings conclusively swing an enterprise away from Linux".

"...swing an enterprise away from..." implies they are already there. They are not. The question should be reversed,"What offerings conclusively swing an enterprise away from Windows?", and the answer is not much (so far).

LDAP is not a substitute for the whole of Active Directory it is a small piece.

Currently there are a broad set of tools to manage thousands of PCs from a core infrastructure, think Puppet or Chef for Windows Desktops. And you can set broad policies about software and access.

That sort of deployment, where you have say a call center with 1,500 people sitting in front of a PC to look up orders and such on their desk. You can update all of them, make sure none of them can surf outside to random web sites, etc.

It is also useful in a large technology enterprise where you have many developers. (Say a large C# shop of contract coders) because the tools help manage workstation build environments etc. When you are a mixed shop it is less useful.

Basically if all of your IT needs can be met by Microsoft products, they have a good story about how you can deploy them, manage them, and maintain them. There isn't a solid open source equivalent. Part of Google's strategy there is 'Chromebook' since if you're running a bunch of terminals that makes things easier to centrally manage.

If you were going to build something in the FOSS space here it would probably impose some strong limits on customizations in order to work. It would also need a way of disabling 'smart' employees from subverting the system (remember the kids who broke through the restrictions in their school issued ipads?) You have to think in the mindset that your employees are not your friends and may be trying to subvert the system :-) The "ideal" (and I put it in scare quotes because most employees hate it) is a workstation that can only run the tools to do your job, and only browse to sites that help you do your job.

I expect we'll get back to that and there will be a 'soft' network for personal devices which is monitored.

Hum. I guess you're right; thinking of people I hired as people I don't trust does change the mindset a lot. I would hate to work for a place like that, and would feel awful about helping build that kind of place. Probably very "hacker" of me. :)

Of course, technically, I can conceptualize that in my own company, I would set up a stock Puppet-based configuration that controlled Debian workstations, build computers, etc. Firewall rules, access rules, login rights, etc - all via puppet.

It does go a bit deeper than not trusting folks[1]. Sometimes you must make sure you comply with information sharing laws in your field (e.g. HIPA). Two, most people are not super computer literate and just want the damn thing to work. Having a standard config that you slap down with their data stored on good servers is actually a pretty helpful thing to them. They don't want control of their machine, they want stability, reliability, and recovery from mistakes. The accountant wants to do his/her job and not learn IT's job.

As much as I'm not a fan of Windows Servers, I understand that they provide a pretty easy, integrated approach. I do wish open source projects would look to that and not think what's available is good enough. People will trade up their Camry for a Lexus, but not willing trade down to a Yaris.

1) although with over 1,000 or 10,000 employees you probably should assume you've hired some damn fools or evil folks - that's just basic numbers

That's the problem your a techie and if your founding a techie company non-MS solutions will work. But if your running a business that's not techinical think insurance agency, mortgage company, etc. You would go down to "best buy" buy a couple of windows boxes run your loan officer product on windows and try not to think about technology again. Where I work we have a product that runs java on the server but requires IE as the browser. 5 prod websphere servers 700 windows boxes for the users. On the development boxes we run tomcat but if there's a production issues they want to be able to call microsoft or IBM.Also, your going to train 700 users to use linux on the desktop. Besides can you lease linuxs boxes from Dell?