search

dotnet / runtime

.NET is a cross-platform runtime for cloud, mobile, desktop, and IoT apps.
https://docs.microsoft.com/dotnet/core/
MIT License
15.32k stars 4.74k forks source link

Support System.DirectoryServices.AccountManagement on Linux(/macOS) #37100

Open FWest98 opened 4 years ago

FWest98 commented 4 years ago

Following the discussion in https://github.com/dotnet/runtime/issues/23944#issuecomment-634850013, this issue is to track adding support for Linux (and/or macOS) to the S.DS.AM namespace. Since S.DS.Protocols is now implemented for all platforms, a logical next step would be to look into the "derived" namespaces.

As for a use-case, I quote myself from the other issue:

I'm working on an application that does a lot of user and group management through S.DS.AM, which I am planning on running in Kubernetes. Currently, it works with Windows hosts and pods within Kubernetes, but that is tricky to manage and some of our toolkit does not work (nicely) with Windows in K8s (for example, secret injection from HashiCorp Vault). Add to that the extra licensing costs and computing resources...

Reworking the application to S.DS.P is probably possible, but very inconvenient and would require significant work, as well as being more cumbersome to work with native LDAP objects instead of full-featured Principal objects from AM.

I believe everything in S.DS.AM is also possible using just S.DS.P, but especially converting existing applications might be too much of a burden to make this feasible for many. On top of that, it is more difficult to manage and it makes the code more difficult to work with in general.

iSazonov commented 4 years ago

S.DS.AM on Windows works with local accounts too. I'd enhance the request to support the same on Unix-s too. On Linux S.DS.AM could utilize PAM.

My request come from PowerShell where is a LocalAccounts module. The module uses non-public API and I port it to S.DS.AM with expectation that S.DS.AM will work on Unix-s in future for local and LDAP accounts.