[quote=“robb, post:10, topic:690, full:true”]
With NS 7 we aim to add Samba4+Kerberos to the services and this will bring the functionality closer to a Windows AD server, and probably closer to Univention functionality. Although I can not tell exactly what it would take since I am not an LDAP/AD/Samba4 expert as you are… [/quote]
I would not say I’m an expert well, perhaps on LDAP
Indeed bringing Kerberos in is definitely a great step ahead especially if other embedded components benefit from this SSO feature. As you stated in another post, it’s all matter of “company size” thus scenario. If you bring Kerberos for small company which may not have a lot of computer, perhaps even not “Windows pro” workstations, then Kerberos is pretty useless because login/password will still be used and domain concept, if we discuss about Windows, doesn’t bring, IMHO, a lot of added value here.
On the other hand, as soon as you expand either scope (more clients, pro Windows workstation or whatever client supporting Kerberos) + admin capability to understand what’s behind, then this is another game: Kerberos, although not perfect will greatly change the way internal (I mean “within the company LAN”) authentication works. Add another external server/application, join Kerberos domain and here you are with SSO and somewhat better security.
Once you’re there, if your Kerberos implementation is Samba4, then you’re are very close to emulate Windows domain.
As you know, this is not as easy as it looks first because Samba team had to make some choices in term of internal design. Like Microsoft, they do maintain their own dedicated LDAP server which can’t really be used as “your” LDAP server for other purposes. One can’t (yet?) customize schema thus solution is to have internal synchronization (I wont write replication) with your LDAP sever, keep Samba LDAP for pure Samba/domain stuff and expose and use your own LDAP for anything else.
Does it mean this is useful only for company with Windows pro clients especially because of GPOs? I’m not so sure but there is room for further debate, for sure