4 ms·

To be fair: while they did leave all the classical 'server' type use cases out in the cold and are making it worse every release, it's not actually the future o

To be fair: while they did leave all the classical 'server' type use cases out in the cold and are making it worse every release, it's not actually the future or the best practice to still roll out. We are in between the legacy 'directory' based networks with authentication etc, and the more robust and expansive beyondcorp type setups. Do you really still need classical 'user' and 'group' membership things? Network accounts? Local web servers? Pretty much anything of significance is in a private or public cloud, if only because the fast pace and scaling. All that is left is basic file sharing that is sometimes done locally, and even that is becoming more and more stupid to implement in a workflow or business process. (regardless of your OS or vendor) There are of course still some true file-based processes where Apple is still used a lot, but even that is no longer local-file-only; a lot of the still and motion processing is done either super small locally or simply distributed to dedicated systems like render farms. And for the 1-man-photo business all of the local stuff still works and you really wouldn't have gotten anything out of 'server' anyway. The most problematic holdouts are the likes of Adobe who refuse to write applications that play nice with NAS-type filesharing so that just leaves you with file syncing instead.

briffle 7y ago
Unfortunately, most compliance policies (SOC2, PCI, HIPAA, SOX, etc) remain very outdated, and make this a challenge for anyone that needs to meet compliance needs.
- closeparen 7y ago
  There are large, serious, public companies on Azure AD, OneLogin, Okta, etc. They often like those services because they eat some of the compliance burden. This doesn't ring true.
Spivak 7y ago
Uhh what? I'm with you that the days of the "trusted internal network" are coming to an end but you're insane if you think that directories are going away. LDAP has certainly fallen out of favor but every SaSS user management platform / service is just implementing what are essentially "noLDAP" directories. What do you think is providing the authentication and user management in those private clouds? OpenLDAP, FreeIPA, ActiveDirectory, Keycloak? And even when you move everything out of the office to a datacenter you still need all normal IT stuff that you needed in your little office rack just in the datacenter now. The only part of the "old-guard" IT stack I see disappearing is the office file server.
- whatsmyusername 7y ago
  Ironically the only thing we run locally is file server, and that’s just an AWS storage gateway backed by S3. Its the only reason we still have an ad server.
  - EvanAnderson 7y ago
    Managing groups of Windows client PCs without Active Directory still hasn't reached feature parity w/ Active Directory. I do not welcome going back to the "herding cats" days of "workgroups", personally.
    - jedieaston 7y ago
      Azure AD and Intune is good enough right now if you don’t need local servers for apps, and very cheap (or maybe free) depending on what you buy from Microsoft. It can secure a device, apply ADMX files, install applications, and if you need more complexity then you can run PowerShell scripts. It’s not really user friendly, but AD and GPO never really was either. Did I mention no CALs?
    - whatsmyusername 7y ago
      We're all Mac. I wouldn't have taken the job otherwise.
- derefr 7y ago
  > What do you think is providing the authentication and user management in those private clouds? SAML. Yes, the provider's own network probably hosts a directory service as the default SAML backend, but for integrating with enterprise clients who already have their own directories? SAML. Now, rather than making ACL assertions about local users, you have to make ACL assertions about what ACL assertions each foreign directory is allowed to make on behalf of its own "guest" users in your environment.
  - gravitas 7y ago
    SAML is a middle tier between the endpoint (user app) and directory (ADFS, LDAP, etc.) and not a single solution on it's own, it doesn't store data - it provides a means for leveraging that data defined by the schema (e.g. posixAccount and groupMember). It's generally equivalent to pam_sss, nss-pam-ldap and friends at the systems layer of your average Linux. They are complementary, not replacements for each other.
kube-system 7y ago
> Do you really still need classical 'user' and 'group' membership things? The move to the cloud has largely made identity management and directory services more widespread, not less.
detaro 7y ago
Small on-site server deployments still make a lot of sense in many cases. Not every business needs scaling so badly it has to make itself dependent on online services, and in many parts of the world "reliable, fast internet at every business location" is still not something you want to need.
swiley 7y ago
1) yes software companies, especially ones that host any kind of public facing app, need to be able to manage authentication. 2) every business is going to have internal applications wether bespoke or something on top of ERP/CRM software so the same applies here. 3) when you use an app (either professionally or personally) you need to have an exit strategy, you’d think Oracle’s latest games would teach everyone that. All these SAAS apps have nothing, so self hosting with directory/file servers is the way to go. 3) MS and Apple OSes really need some of these things to function in a corporate environment. Unless you’ve got everyone on Linux or are doing BYOD then you’re going to need directory servers to coordinate IT.

briffle 7y ago

Unfortunately, most compliance policies (SOC2, PCI, HIPAA, SOX, etc) remain very outdated, and make this a challenge for anyone that needs to meet compliance needs.

closeparen 7y ago
There are large, serious, public companies on Azure AD, OneLogin, Okta, etc. They often like those services because they eat some of the compliance burden. This doesn't ring true.

Spivak 7y ago

Uhh what? I'm with you that the days of the "trusted internal network" are coming to an end but you're insane if you think that directories are going away. LDAP has certainly fallen out of favor but every SaSS user management platform / service is just implementing what are essentially "noLDAP" directories. What do you think is providing the authentication and user management in those private clouds? OpenLDAP, FreeIPA, ActiveDirectory, Keycloak? And even when you move everything out of the office to a datacenter you still need all normal IT stuff that you needed in your little office rack just in the datacenter now. The only part of the "old-guard" IT stack I see disappearing is the office file server.

whatsmyusername 7y ago
Ironically the only thing we run locally is file server, and that’s just an AWS storage gateway backed by S3. Its the only reason we still have an ad server.
- EvanAnderson 7y ago
  Managing groups of Windows client PCs without Active Directory still hasn't reached feature parity w/ Active Directory. I do not welcome going back to the "herding cats" days of "workgroups", personally.
  - jedieaston 7y ago
    Azure AD and Intune is good enough right now if you don’t need local servers for apps, and very cheap (or maybe free) depending on what you buy from Microsoft. It can secure a device, apply ADMX files, install applications, and if you need more complexity then you can run PowerShell scripts. It’s not really user friendly, but AD and GPO never really was either. Did I mention no CALs?
  - whatsmyusername 7y ago
    We're all Mac. I wouldn't have taken the job otherwise.
derefr 7y ago
> What do you think is providing the authentication and user management in those private clouds? SAML. Yes, the provider's own network probably hosts a directory service as the default SAML backend, but for integrating with enterprise clients who already have their own directories? SAML. Now, rather than making ACL assertions about local users, you have to make ACL assertions about what ACL assertions each foreign directory is allowed to make on behalf of its own "guest" users in your environment.
- gravitas 7y ago
  SAML is a middle tier between the endpoint (user app) and directory (ADFS, LDAP, etc.) and not a single solution on it's own, it doesn't store data - it provides a means for leveraging that data defined by the schema (e.g. posixAccount and groupMember). It's generally equivalent to pam_sss, nss-pam-ldap and friends at the systems layer of your average Linux. They are complementary, not replacements for each other.

kube-system 7y ago

> Do you really still need classical 'user' and 'group' membership things? The move to the cloud has largely made identity management and directory services more widespread, not less.

detaro 7y ago

Small on-site server deployments still make a lot of sense in many cases. Not every business needs scaling so badly it has to make itself dependent on online services, and in many parts of the world "reliable, fast internet at every business location" is still not something you want to need.

swiley 7y ago

1) yes software companies, especially ones that host any kind of public facing app, need to be able to manage authentication. 2) every business is going to have internal applications wether bespoke or something on top of ERP/CRM software so the same applies here. 3) when you use an app (either professionally or personally) you need to have an exit strategy, you’d think Oracle’s latest games would teach everyone that. All these SAAS apps have nothing, so self hosting with directory/file servers is the way to go. 3) MS and Apple OSes really need some of these things to function in a corporate environment. Unless you’ve got everyone on Linux or are doing BYOD then you’re going to need directory servers to coordinate IT.