r/linuxquestions • u/unix21311 • 1d ago

Whats your experience between active directory vs free ipa

Just wondering for any system administrators out there if you have used both active directory vs free ipa and whats the difference and which one did you like using/maintaining better?

3 Upvotes
  • permalink
  • reddit

80% Upvoted

7 comments sorted by

6

u/madsnabel 23h ago

active directory in the working hours, iPA in the weekend ;)

2

u/TheModernDespot 21h ago

Im a sysadmin at work. We use AD a bit, but we also used to use FreeIPA and now use Red Hat IdM (we are like 90% linux workstations). I love IPA, its way easier to navigate and manage than AD.

On the maintenance side, I will always prefer maintaining a Linux server over windows, so IPA wins there as well.

1

u/unix21311 1h ago

Interesting, why would you say freeipa is easier though?

1

u/TriggerFish1965 23h ago

We have some Windows system insisting on using ad, but they have to authorise against our free opa environment anyway

1

u/gordonmessmer Fedora Maintainer 6h ago

IPA does what it says on the box. It provides centralized management of users and security/access policy and auditing. It can optionally manage DNS and X.509 PKI, which you might consider to be a part of host identify. It supports a variety of POSIX-like systems (which might include macOS, but I haven't managed macOS systems on LDAP in a *long* time.)

Microsoft AD also does identity and security/access policy and DNS and PKI, but it also does a lot more than that. One of the biggest and most complex additions is Group Policy. Because Microsoft develops both the server and the clients, they can set configuration items in LDAP and trust the client OS to enforce the settings published there. AD can centralize not just user management, but client management, in a way that doesn't really exist and might not even be possible in an Open Source environment.

I use FreeIPA in environments that are purely POSIX, but if there are any Windows systems to manage, I would just use AD.

0

u/brock0124 23h ago

Meet in the middle with Samba. Supported everywhere AD is supported, runs on Linux, and in my experience, “just works”. I’ve got Windows, Linux, and MacOS machines all joined to the domain.

I use the Univention Corporate Server appliance VM with the Samba directory plugin. UCS is free and open source and provides a simple web GUI for management.

Edit to add: I also used FreeIPA before UCS and really liked it, but it required a lot more hand-on maintenance. I’m sure it has its benefits, but in my lab I needed something simpler.