Authenticate Linux Clients with Active Directory (Technet)

Having actually gone through this recently to setup Linux clients against an Active Directory server and tried all the options I can say the article is basically right that winbind is the best answer - that said, I don't use it yet at my shop because it has been too buggy in the 3.2 series.. Winbind has at least 4 key improvements against ldap or ldap+kerb
1) It is caching and uses AD caching hints to speed it up. 3.2 can even do off-line caching like windows for roaming users (!!!)
2) It mutually authenticates and encrypts all LDAP communication with kerberos without extra setup (MS's choices make it so that if you don't do this there is a raft of annoying configuration you have to do on the AD server)
3) It can detect and fail over (and back) to multiple AD servers
4) Password expiry, and forced change prior to logon works

Using Linux with an AD server is dead easy once you figure it out and provides real benefits to the Linux environment. If you have AD servers and are not using them as Kerberos servers with Linux you're really missing out...

The main sore point on the Linux side is that if you have Windows machines there is no free replacement for AD that is compatible with Windows clients and you pretty much have to have Windows Server to get the Windows clients working sanely. Samba 4 is the hope to fix this, but it seems far away still.

Unfortunately the samaba documentation is way out of date on how to do all this. Even if you don't want to use winbind, using 'net ads join|keytab' commands to manage the kerberos keys from ADS makes the client side pure kerberos setup dead easy. Modern MIT Kerberos even automatically uses SRV records and the like so configuration boils down to just setting the default realm.

Even the whole old problems with MS's Kerberos extensions seems completely put to rest these days. The kerberos libraries are now completely compatible by default and the Samba team has cracked the PAC and so on.

In the end the actual steps are pretty simple to get kerberdized ssh, apache, exim, dovecot and samba that fully interoperates for single sign on with windows clients and linux clients. But it was a total bitch to figure out due to the lack of up to date docs :( Particularly on the multi-homed SPN side...