You should carry a vote for the release with samba-AD capabilities.

However I will put my two cents in.

I myself, have personally never used SAMBA in a Domain Controller sense for a couple of reasons beyond very simple file sharing, which I do use it for:

1) Mixing Microsoft Infrastructure with authentication requirements across platforms doesn't make any operational sense to me.

For example, I have to patch my Windows servers, so why are my Linux boxes down in my HADOOP cluster or more importantly, why did all of my jobs just fail on the cluster because there is no AD service available for whatever reason?

2) I need to add a linux box, but I don't have the proprietary non linux licenses to do so.

Seems sort of odd a licensing issue with application server infrastructure, say a Microsoft platform is preventing me from installing a Linux server.

3) Same for same, Why can't I pick and choose what windows commercial products I need, and discount them because they are or not open source/open standards?  Not all software is open and I find keeping Linux out of such environments is a huge plus in operational sanity and the support calls to the companies who build such products are more understanding.

4) That being said AD is getting long in the tooth now days as the browser takes over and everything just works in the cloud now.  If you don't adhere to typical open standards none of your stuff will work.  So AD I consider legacy infrastructure anyway.  Plenty of WAY better ways to share files and approve access to applications and files/printing...etc with just LDAP and none of the baggage of AD.

So these are some of the reasons why I would limit testing and devote time to something more achievable.

THAT BEING SAID, you can test DOMAIN joins and operations between Linux Infrastructure, and just leave the windows testing out. THAT is certainly not a waste of time as whatever problem is traceable and trackable.  That certainly makes the SAMBA packages better as all testing is within the confines of the source tree of SAMBA client and server and saves you a lot of reporting headaches.

So I would vote for LIMITED testing within the Linux Eco System, but not include Microsoft testing proper.  (Setting up Domain Joins for example on Windows 11/10 Windows Server products etc.)

People can file bug reports with the SAMBA foundation if they have issues with Microsoft AD.  SAMBA is getting fairly good now days and I don't think people would mind the odd bug or two in the implementation case.

So what I mean to say here is SAMBA is already pretty well tested outside of Fedora, so I think the risk is pretty small for major issues.

Case in point 3 months ago I installed a complete AD domain on a Fedora box in about 5 minutes.  Super simple to do and it worked flawlessly with Windows 10/11 and Server 2019 Fedora 37.  No Workstation join issues, or wierd policy affects at least in authentication anyway.

It has been running ever since, diligently protecting all my Mainecoon pictures and does a very fine job of preventing anyone from stealing them if you don't have the right AD password.


On Sat, Jun 17, 2023 at 10:37 PM Adam Williamson <adamwill@fedoraproject.org> wrote:
Hi folks! I want to talk about the Active Directory requirements in the
release criteria.

Since Fedora Server was created, we've had this in the criteria:

"It must be possible to join the system to a FreeIPA or Active
Directory domain at install time and post-install, and the system must
respect the identity, authentication and access control configuration
provided by the domain."

...plus various further requirements at Beta and Final.

For FreeIPA we have this testing entirely automated, it's no problem at
all. For Active Directory we...don't. At every release point this does
not get tested until very late. Often Stephen Gallagher has to test it
manually at the very last minute, which is an unfair burden on him.
When we *do* find problems, there is a mad scramble to fix them or at
least find workarounds, because we find them way too late.

We've looked into automating it and still kinda intend to do so, but
it's not really simple. There's a legal side to it - it's not clear
what the licensing requirements involved would be - and a technical
side to it - we'd need a way to reliably and quite quickly deploy an AD
domain controller using openQA automation, which is not a trivial job.

When I estimate the time that's going to take and consider what *else*
I (or anyone else) could do with that time, I'm not certain that
"automating AD testing" is the best use of it. To me it doesn't feel
like a really key feature of Fedora to the point that would justify the
work involved, or justify continuing to throw Stephen and others under
the last-minute-manual-testing bus. But I'm not sure!

What do others think? Do you use the AD client support of Fedora
Server? Do you think it's a key feature that we should keep as a
release-blocking requirement, or no?

Thanks!
--
Adam Williamson (he/him/his)
Fedora QA
Fedora Chat: @adamwill:fedora.im | Mastodon: @adamw@fosstodon.org
https://www.happyassassin.net



_______________________________________________
server mailing list -- server@lists.fedoraproject.org
To unsubscribe send an email to server-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/server@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue