4 ms·

Azure Active Directory support is pretty significant, means any company that uses Microsoft MDM can now support engineers who prefer linux machines.

ocdtrekkie 5y ago
Note this support appears to specifically describe an on-premise Active Directory server, with group policy. Azure AD tends not to support GPOs, though you can get basically Azure-hosted AD servers that do.
adolfojp 5y ago
I don't think it supports AAD, just AD. You got me way too exited for a minute.
- easton 5y ago
  It's kind of odd that they are advertising this now just as Microsoft is trying to get everyone to ditch on-prem AD. Is it just them saying "we ship SSSD in the default install now, so you can buy support from us!", or what? Some way of signing into Ubuntu with a custom SAML provider would be very cool. Windows supports it via their "credential provider"[0] framework and Google uses that to provide sign-in for Windows with your GSuite credentials. [0]: https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows https://docs.microsoft.com/en-us/windows/win32/secauthn/cred...
  - e12e 5y ago
    I certainly hope ms will drop the need for ad (in favour of azure ad) - but it's still needed for eg azure virtual desktop (you need a vm running ad - or "azure ad ds"[1] in azure parlance). A bit frustrating, as you can otherwise join a windows 10 desktop (or vm) to just azure ad for sso etc. [1] https://docs.microsoft.com/en-us/azure/active-directory-domain-services/overview https://docs.microsoft.com/en-us/azure/active-directory-doma...
    - easton 5y ago
      That's still the most bizarre product decision Microsoft has made (to me) in the past 5 years. They are trying to get everyone to Azure and Azure AD, then they launch a product that is basically Citrix but 50% of the cost, with the catch that you need to still have on-prem AD to use it. What?
      - merb 5y ago
        > 50% of the cost well that depends, the higher subscriptions include it for free.
        easton 5y ago
        I should of been more specific. The higher subscriptions include the licensing, so you just have to pay for compute, vs Citrix where you have to pay for Citrix Licensing, Windows Licensing, and compute.
  - merb 5y ago
    actually there is a way to support azure ad for servers: https://docs.microsoft.com/de-de/azure/virtual-machines/linux/login-using-aad https://docs.microsoft.com/de-de/azure/virtual-machines/linu... it uses device authentiction. sadly not for desktops, btw. you can create your own pam provider (grant_type=password) and put it into sssd (for local cache), but that does not work with 2fa.
Koffiepoeder 5y ago
To be honest I'm not a fan of this. Linux was one of the few ways to stay free of the behemoth of corporate, invasive crapware that is forced upon employees. By evolving towards a full enterprise managed OS (with stuff like AD) this freedom will more and more be corrupted.
- fiberoptick 5y ago
  Well, at companies that actually care about 100% rollout of "corporate, invasive crapware" on computers that _they own_ and that are used to process _company data_ and access _company resources_, the alternative is usually just to ban Linux workstations altogether. I see this as a strict improvement for adoption of Linux workstations in the corporate world
  - lordlimecat 5y ago
    I'm not aware of ubuntu now supporting "rollout of corporate crapware" via this AD support. MSIs still dont work on Ubuntu. GPOs are still very limited-- mostly just HBAC type stuff. The stuff that works is the important stuff, but if people want to roll out software to Linux they aren't doing it with AD. They're doing it with a CM tool like puppet or ansible.
  - tarsinge 5y ago
    This or everything in web apps in a browser, pick your poison.
- Spivak 5y ago
  Also AD support is small potatoes compared to products like CarbonBlack which are already deployed on Linux. Having "Puppet but controlled by GPO" isn't really new.
- TruthWillHurt 5y ago
  Linux had AD integrations 15 years ago. You just had to configure Kerberos yourself (oh, how often have I googled "Linux AD interoperability"...)

ocdtrekkie 5y ago

Note this support appears to specifically describe an on-premise Active Directory server, with group policy. Azure AD tends not to support GPOs, though you can get basically Azure-hosted AD servers that do.

adolfojp 5y ago

I don't think it supports AAD, just AD. You got me way too exited for a minute.

easton 5y ago
It's kind of odd that they are advertising this now just as Microsoft is trying to get everyone to ditch on-prem AD. Is it just them saying "we ship SSSD in the default install now, so you can buy support from us!", or what? Some way of signing into Ubuntu with a custom SAML provider would be very cool. Windows supports it via their "credential provider"[0] framework and Google uses that to provide sign-in for Windows with your GSuite credentials. [0]: https://docs.microsoft.com/en-us/windows/win32/secauthn/credential-providers-in-windows https://docs.microsoft.com/en-us/windows/win32/secauthn/cred...
- e12e 5y ago
  I certainly hope ms will drop the need for ad (in favour of azure ad) - but it's still needed for eg azure virtual desktop (you need a vm running ad - or "azure ad ds"[1] in azure parlance). A bit frustrating, as you can otherwise join a windows 10 desktop (or vm) to just azure ad for sso etc. [1] https://docs.microsoft.com/en-us/azure/active-directory-domain-services/overview https://docs.microsoft.com/en-us/azure/active-directory-doma...
  - easton 5y ago
    That's still the most bizarre product decision Microsoft has made (to me) in the past 5 years. They are trying to get everyone to Azure and Azure AD, then they launch a product that is basically Citrix but 50% of the cost, with the catch that you need to still have on-prem AD to use it. What?
    - merb 5y ago
      > 50% of the cost well that depends, the higher subscriptions include it for free.
      - easton 5y ago
        I should of been more specific. The higher subscriptions include the licensing, so you just have to pay for compute, vs Citrix where you have to pay for Citrix Licensing, Windows Licensing, and compute.
- merb 5y ago
  actually there is a way to support azure ad for servers: https://docs.microsoft.com/de-de/azure/virtual-machines/linux/login-using-aad https://docs.microsoft.com/de-de/azure/virtual-machines/linu... it uses device authentiction. sadly not for desktops, btw. you can create your own pam provider (grant_type=password) and put it into sssd (for local cache), but that does not work with 2fa.

Koffiepoeder 5y ago

To be honest I'm not a fan of this. Linux was one of the few ways to stay free of the behemoth of corporate, invasive crapware that is forced upon employees. By evolving towards a full enterprise managed OS (with stuff like AD) this freedom will more and more be corrupted.

fiberoptick 5y ago
Well, at companies that actually care about 100% rollout of "corporate, invasive crapware" on computers that _they own_ and that are used to process _company data_ and access _company resources_, the alternative is usually just to ban Linux workstations altogether. I see this as a strict improvement for adoption of Linux workstations in the corporate world
- lordlimecat 5y ago
  I'm not aware of ubuntu now supporting "rollout of corporate crapware" via this AD support. MSIs still dont work on Ubuntu. GPOs are still very limited-- mostly just HBAC type stuff. The stuff that works is the important stuff, but if people want to roll out software to Linux they aren't doing it with AD. They're doing it with a CM tool like puppet or ansible.
- tarsinge 5y ago
  This or everything in web apps in a browser, pick your poison.
Spivak 5y ago
Also AD support is small potatoes compared to products like CarbonBlack which are already deployed on Linux. Having "Puppet but controlled by GPO" isn't really new.
TruthWillHurt 5y ago
Linux had AD integrations 15 years ago. You just had to configure Kerberos yourself (oh, how often have I googled "Linux AD interoperability"...)