samba - Mar 2022 - Protocol differences between RFC and Active Directory?

On Thu, 2022-03-17 at 23:09 +0100, HolyTaint via samba
wrote:
> On Fri, 18 Mar 2022 10:26:36 +1300 Andrew Bartlett via samba <
> samba at lists.samba.org> wrote:
> > On Thu, 2022-03-17 at 21:54 +0100, HolyTaint via samba wrote:
> > > What are the protocol differences between RFC LDAP and Active
> > > Directory LDAP implementation that make hard if not impossible
> > > having
> > > OpenLDAP taking samba role as AD LDAP interface?
> > > Ex, single common name, then?
> > 
> > There are a lot.  The thing that trips up most is authenticated by
> > default, but the schema is just different, the typical layouts are
> > different.
> > 
> > If there are particular niggles that really annoy, we could take
> > patches provided they don't break AD behaviour, eg accepting the
> > OpenLDAP password change control.
> > 
> > Andrew Bartlett
> 
> I'm interested especially about those explicitly violating the
> standard, and I'd be more than happy about references and
> documentation on this stuff. Sadly I didn't find any & in my
personal
> experience samba wiki is a mess to search in
It all depends on what standards you mean, Samba when running as a DC
tries to comply with Microsoft ldap standards, for obvious reasons.
Much work has been attempted to use openldap with Samba AD and it never
came to fruition, the differences appear to be too great. If anyone can
get Samba AD to work with openldap, then I am sure that patches would
be very welcome, but I will not hold my breath waiting.

Having said all that, you can use the ldap built into Samba AD with
other programs, possibly by extending the schema.

Rowland

On Thu, 17 Mar 2022 22:21:07 +0000 Rowland Penny via samba <samba at
lists.samba.org> wrote:
> On Thu, 2022-03-17 at 23:09 +0100, HolyTaint via samba wrote:
> > On Fri, 18 Mar 2022 10:26:36 +1300 Andrew Bartlett via samba <
> > samba at lists.samba.org> wrote:
> > > On Thu, 2022-03-17 at 21:54 +0100, HolyTaint via samba wrote:
> > > > What are the protocol differences between RFC LDAP and
Active
> > > > Directory LDAP implementation that make hard if not
impossible
> > > > having
> > > > OpenLDAP taking samba role as AD LDAP interface?
> > > > Ex, single common name, then?
> > > 
> > > There are a lot.  The thing that trips up most is authenticated
by
> > > default, but the schema is just different, the typical layouts
are
> > > different.
> > > 
> > > If there are particular niggles that really annoy, we could take
> > > patches provided they don't break AD behaviour, eg accepting
the
> > > OpenLDAP password change control.
> > > 
> > > Andrew Bartlett
> > 
> > I'm interested especially about those explicitly violating the
> > standard, and I'd be more than happy about references and
> > documentation on this stuff. Sadly I didn't find any & in my
personal
> > experience samba wiki is a mess to search in
> 
> It all depends on what standards you mean, Samba when running as a DC
> tries to comply with Microsoft ldap standards, for obvious reasons.
> Much work has been attempted to use openldap with Samba AD and it never
> came to fruition, the differences appear to be too great. If anyone can
> get Samba AD to work with openldap, then I am sure that patches would
> be very welcome, but I will not hold my breath waiting.
> 
> Having said all that, you can use the ldap built into Samba AD with
> other programs, possibly by extending the schema.
> 
> Rowland
Of course the differences appear too great, but it would be nice if they'd
be listed and documented (that's what I'm interested in, more than
solving the problem), second best solution would be partial or total
documentation of Samba specific behaviour concerning AD LDAP simulation