21–30 of 65 posts
Earlier quoted context omitted.
Yes. And Microsoft Active Directory has integrated this stack with an easy to use graphical interface for almost 30 years now.
Active directory is dying along with local computer networks. Microsoft is pushing customers to Entra (formerly Azure Active directory). Modern, hybrid AD is not easy to use and difficult to manage.
First, I read (article referred to in blog post): https://blog.hofstede.it/integrating-freebsd-15-with-freeipa... [1] . _Only then_ I read https://vermaden.wordpress.com/2026/02/18/native-freebsd-ker... [2] [1] is more high level. [2] is a bit more detailed.
I treat my blog also as a place where I keep and maintain my FreeBSD documentation/information.
So there are several motivations for this:
- Keep and maintain personal version with more code snippets that I can copy/paste fast.
- More detailed commands and outputs.
- Some additional improvements that may be useful – like local console login.
Hope that helps.
Earlier quoted context omitted.
Yes. And Microsoft Active Directory has integrated this stack with an easy to use graphical interface for almost 30 years now.
Active directory is dying along with local computer networks. Microsoft is pushing customers to Entra (formerly Azure Active directory). Modern, hybrid AD is not easy to use and difficult to manage.
But, I wonder if Microsoft might reverse their stance on EntraID being SaaS; with the handwringing about sovreignty from Europe.
Back when "the deal" was made with Microsoft to basically embed itself into the digital ecosystem of every government, major institution and company in Europe: it was not the case that a member of the european parliament could have their mail disabled arbitrarily by Microsoft- such a thing was technically possible through a lot of hoops but it was significantly less feasible.
If Microsoft was to reverse course then I'm sure it would stop all the handwringing, even if people would continue to use the EntraID product in reality.
Earlier quoted context omitted.
Active directory is dying along with local computer networks. Microsoft is pushing customers to Entra (formerly Azure Active directory). Modern, hybrid AD is not easy to use and difficult to manage.
There's https://himmelblau-idm.org/ for a Linux client for Entra. Haven't tried it myself though.
Nice. I run a very similar setup, but opted for a stack of OpenLDAP / MIT Kerberos / PowerDNS on my "domain controllers." OpenLDAP does multimaster replication and is the backend for DNS records and the Kerberos database. The hardest part was figuring out OpenLDAPs configuration syntax, especially the correct ldif incantations for things like nested group memberOf= queries, schemas, and ACLs. It's somewhat inscrutabl…
Would be highly interested in learning more about this setup particularly the PowerDNS integration.
For each of my "domain controllers, I run: OpenLDAP, an MIT Kerberos KDC, and a PowerDNS server. The KDC and PowerDNS both get their data from LDAP on 127.0.0.1, and LDAP changes are synchronized between all the nodes.
This is convenient because you don't have to synchronize zone files on multiple hosts.
I use custom /bin/sh-based config management system, but you can probably get the gist of it here:
https://github.com/cullumsmith/infrastructure/blob/master/sc...
https://github.com/cullumsmith/infrastructure/blob/master/fi...
I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.
I have always been convinced it was on purpose. It's the point where you were supposed to decide paying Redhat is actually a good idea and nowadays it pushes towards a cloud based authentication solution you can integrate.
Realistically, who has any interest in fixing the mess?
Earlier quoted context omitted.
Active directory is dying along with local computer networks. Microsoft is pushing customers to Entra (formerly Azure Active directory). Modern, hybrid AD is not easy to use and difficult to manage.
> dying along with local computer networks I have seen the exact opposite, with people moving to things like jumpcloud, keycloak, authentik, etc.
I feel this is one of the weaknesses of Linux/unix ecosystem. The freeipa/sssd/nss/pam/krb/ldap/dns (+keycloak/samba/...) etc stack is just incredibly byzantine. I'm sure it is technically very capable in the right hands, but to me it feels like intractable mountain of things and worst of all the failure modes are pretty bad; you can accidentally leave security holes or alternatively lock yourself out.
It's always been awful. OpenLDAP by itself is already attrocious and a pain to make work. I have always been convinced it was on purpose. It's the point where you were supposed to decide paying Redhat is actually a good idea and nowadays it pushes towards a cloud based authentication solution you can integrate. Realistically, who has any interest in fixing the mess?
Okta is a multi billion dollar company, there is a lot of venture opportunity in this space.
To my question, does anyone know if FreeIPA now supports integration with Samba including password auth for non domain members? Or is it still limited to Kerberos?