What is the best, or most reliable, way to manage my Unix/Linux user accounts with ActiveDirectory? Or, is this even feasible?
Identity Management with ActiveDirectory
active directory;ldap;authentication;pam
I highly highly highly (highly) recommend using Likewise Open to do this. Every time I talk about them, I sound like a paid shill, but I'm not. It's just really that good. Essentially, you install the software (painless, there's an RPM and DEB intaller), run domainjoin-cli domain.com adminuser, type the password for adminuser, and then your machine is part of the AD domain. The one thing that I do change is in the configuration, I turn on the the assume default domain setting, because I don't want my users to have to type their domain every time they connect to the machine. The benefits are huge. When you log in with AD credentials, your UID and GIDs are assigned based on a hash, which means that they're the same across the entire infrastructure. This means that things like NFS work. In addition, it's simple to get things like Samba and Apache to authenticate, since Likewise configures PAM. Thanks to Likewise Open, there is not a single network-based service that I offer that isn't authenticated against AD.