Dustin C. Hatch
c95a96a33c
The Samba AD domain performs two important functions: centralized user identity mapping via LDAP, and centralized authentication via Kerberos/GSSAPI. Unfortunately, Samba, on both domain controllers and members, is quite frustrating. The client, _winbind_, frequently just stops working and needs to have its cache flushed in order to resolve user IDs again. It also takes quite a lot of memory, something rather precious on Raspberry Pis. The DC is also somewhat flaky at times, and cumbersome to upgrade. In short, I really would like to get rid of as much of it as possible. For most use cases, OIDC can replace Kereros. For SSH specifically, we can use SSH certificates (which are issued to OIDC tokens). Unfortunately, user and group accounts still need ID numbers assigned, which is what _winbind_ does. In reality, there's only one user that's necessary: _dustin_. It doesn't make sense to bring along all the baggage of Samba just to map that one account. Instead, it's a lot simpler and more robust to create it statically.