[Freeipa-users] IMPORTANT: Your input requested: SSSD LDAP Provider vs Winbind

[Ondrej Valousek]

My story is here:

https://bugzilla.redhat.com/show_bug.cgi?id=652609

And it seems to go nowhere. So, in quick - I still believe winbind is a piece of crap really (Simo forgives) for the reasons outlined above 
in the link.
For the same reasons I believe you, SSSD engineers, are wasting your time with the winbind plugin.
If configured properly, sssd can do a much better job.

Now I do not know how much AD differs from the IPA domain from the SSSD prospective - so I do not know how much extra work is needed to be 
able to properly cope with AD, but I still believe some of the code can be later re-used for pure IPA domains (see the AD sites in DNS for 
example).

So in short again, I think SSSD should continue to concentrate its main effort in the IPA integration because we (Linux community) currently 
do not have anything else to match Active Directory - and if we get an SSSD-AD integration as a side-effect, well, a nice bonus! :-)

Ondrej




On 12/02/2011 03:15 PM, Stephen Gallagher wrote:
> When we originally designed SSSD, we looked at it as a solution for
> dealing with LDAP and Kerberos identity and authentication for Linux and
> UNIX clients. With our initial approach, we decided to include only
> marginal support for Microsoft's Active Directory as a source of user
> information (only supporting it when it is enabled for use with
> posixAccount and posixGroup object classes).
>
> Our original assumption was that for complicated deployments relying on
> Active Directory, users would prefer to continue using Winbind. It has a
> very long history and is specifically designed around managing the
> peculiarities of Microsoft's LDAP implementation.
>
> Of late, it has become apparent that many users are opting to "jump
> ship" from winbind to SSSD for use with Active Directory. This has been
> shown by a sharp uptick in community bug reports with Active Directory
> servers.
>
> Up until now, our plans around Active Directory have circulated around
> including a "Winbind Provider" into SSSD, similar to the LDAP provider
> but making use of the original winbind features found in the Samba
> project. However, it's beginning to seem like users are expressing an
> interest to move AWAY from that solution.
>
> This may result in a change in our strategy going forward. I'm looking
> for users to describe to us the reasons why they're choosing SSSD (in
> its current incarnation) over winbind. What I'm trying to sort out is
> whether there are specific *issues* with winbind that SSSD is solving
> for users. In other words, I'm trying to determine whether our decision
> to write and support a winbind provider backend is misplaced.
>
> It may be that if SSSD's LDAP provider is offering a significant
> advantage over winbind, we will consider dropping (or deferring) our
> efforts to integrate winbind and instead put that effort into adding
> Active Directory-specific features into the LDAP provider. For example,
> we might reprioritize bugs https://fedorahosted.org/sssd/ticket/995 and
> https://fedorahosted.org/sssd/ticket/996
>
> So please, share with us your stories for why you prefer SSSD over
> winbind and help us choose our direction for SSSD's future.
>
>
> _______________________________________________
> Freeipa-users mailing list
> Freeipa-users at redhat.com
> https://www.redhat.com/mailman/listinfo/freeipa-users


The information contained in this e-mail and in any attachments is confidential and is designated solely for the attention of the intended recipient(s). If you are not an intended recipient, you must not use, disclose, copy, distribute or retain this e-mail or any part thereof. If you have received this e-mail in error, please notify the sender by return e-mail and delete all copies of this e-mail from your computer system(s).
Please direct any additional queries to: communications at s3group.com.
Thank You.
Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 378073.
Registered Office: South County Business Park, Leopardstown, Dublin 18
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20111202/24b6b161/attachment.htm>