When building enterprise infrastructure, directory services need to handle three critical functions:

• Centralized Authentication: Kerberos/LDAP integration
• Policy Enforcement: GPO-like functionality for Linux/Windows
• High Availability: Multi-master replication capabilities

1. Samba 4 as Active Directory Domain Controller

Samba's AD implementation provides near-perfect compatibility:

# Install Samba AD DC on Ubuntu
sudo apt install samba krb5-config winbind
sudo samba-tool domain provision --use-rfc2307 --interactive
sudo systemctl start samba-ad-dc.service

Key Features:

• Full AD DC implementation (since Samba 4.0)
• NT4-style and Kerberos authentication
• Group Policy Objects support via samba-gpupdate

2. FreeIPA for Linux-Centric Environments

Red Hat's solution for identity management:

# Basic FreeIPA server setup
ipa-server-install --setup-dns --forwarder=8.8.8.8 \
  --hostname=ipa.example.com \
  --ip-address=192.168.1.10

Windows Integration Tip:

# Cross-realm trust setup
ipa trust-add --type=ad example.com \
  --admin Administrator \
  --password

SSSD for Unified Authentication

System Security Services Daemon bridges Linux and AD:

[sssd]
domains = example.com
config_file_version = 2
services = nss, pam

[domain/example.com]
id_provider = ad
access_provider = ad
ad_domain = example.com
krb5_realm = EXAMPLE.COM
cache_credentials = True

For Samba: Use DRBD + Corosync for multi-master replication

For FreeIPA: Built-in CA-backed replication

# Check replication status in FreeIPA
ipa-replica-manage list
ipa-csreplica-manage list

• PBIS Open: Formerly Likewise, provides GPO parsing
• Centrify Express: Limited free tier with policy support
• Cockpit Projects: Web UI for policy management

Keycloak + LDAP Sync for modern web apps:

// Keycloak LDAP federation config
{
  "connectionUrl": "ldap://ldap.example.com:389",
  "usersDn": "ou=users,dc=example,dc=com",
  "bindDn": "cn=admin,dc=example,dc=com",
  "bindCredential": "password",
  "uuidLDAPAttribute": "entryUUID"
}

For organizations transitioning from Windows, Samba 4 provides the smoothest migration path. Linux-centric shops will prefer FreeIPA's tighter integration with SELinux and other Linux security frameworks.

---

When architecting infrastructure solutions for organizations, the directory service backbone requires careful evaluation. Let's examine proven open-source alternatives that deliver:

• Centralized authentication (LDAP/Kerberos)
• Policy enforcement capabilities
• Cross-platform trust relationships

The most complete open-source AD implementation, supporting:

# Install Samba4 as AD DC
sudo apt install samba krb5-config winbind
samba-tool domain provision --use-rfc2307 \
--interactive

Key advantages:

• Full NT4-style domain controller functionality
• Group Policy Objects (GPO) support via samba-gpupdate
• Seamless Windows/Linux trust relationships

For pure Linux environments, FreeIPA provides:

# FreeIPA server installation
ipa-server-install --domain=example.com \
--realm=EXAMPLE.COM --ds-password=Secret123 \
--admin-password=AdminSecret123 --setup-dns \
--unattended

Core components include:

• 389 Directory Server (LDAP backend)
• MIT Kerberos KDC
• Dogtag PKI for certificate management

For modular deployments, consider:

# Basic OpenLDAP configuration
dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcSuffix: dc=example,dc=com
olcRootDN: cn=admin,dc=example,dc=com
olcRootPW: {SSHA}hashed_password
olcDbDirectory: /var/lib/ldap
olcDbIndex: objectClass eq

Enhance with:

• SSSD for authentication caching
• GPO-like policies through Cockpit
• Multi-master replication via syncrepl

For mixed Windows/Linux environments:

# Realmd configuration for AD join
sudo apt install realmd sssd adcli
sudo realm discover example.com
sudo realm join --user=admin example.com \
--computer-ou="OU=Linux,DC=example,DC=com"

Key integration points:

• Cross-platform user identity mapping
• Kerberos ticket forwarding
• Conditional access policies

Ensure high availability with:

# Samba4 replication setup
samba-tool drs showrepl
samba-tool drs replicate destination-DC source-DC \
DC=example,DC=com --full-sync

Monitoring considerations:

• LDAP sync status checks
• Kerberos ticket renewal monitoring
• DNS SRV record validation