FreeIPA vs Active Directory

FreeIPA is licensed under GPL-3.0-or-later, so the project itself does not charge a per-user or per-server license fee. It is packaged in Fedora, Debian and CentOS, and in Red Hat Enterprise Linux as Identity Management, so you can take it from the distribution you already run. Most of the cost sits in the operating system entitlement, the people who deploy and operate the service, and any paid support you buy from the distribution vendor. Support terms, response commitments and version lifecycles come from that vendor's contract, so they should be read in writing before you rely on them.

• Copyleft obligations: GPL-3.0-or-later requires specific obligations when you distribute modified code. Internal use and distribution are different cases, so confirm the position with counsel if you plan to ship changes.
• Distribution choice: the same code arrives through several distributions with different release cadences. The packaged version you deploy is the version you support.
• Bundled or separate support: check whether support is included in your operating system subscription or sold separately, and which versions it covers.
• Operating staff: Linux administration and Kerberos and LDAP skills are recurring costs, and often the largest line item after the first deployment.

Ask which distribution and version you would run, who supports it, and whether that support is included with your existing entitlement.

Active Directory Domain Services is a role in Windows Server, so its license cost is part of your Windows Server edition, your client access licenses and the Microsoft agreement your organization buys under. Windows Server 2025 became available on November 1, 2024. Mainstream support ends November 14, 2029 and extended support ends November 15, 2034, according to Microsoft's lifecycle page for the release. Those dates shape the timing and cost of your domain controller upgrades over the life of the deployment.

• Edition fit: confirm which Windows Server edition covers your domain controllers and the hosts that run them, including your virtualization design.
• Client access licenses: CAL requirements depend on how you count users and devices and on the agreement type. Confirm counts and terms in writing with Microsoft and your reseller.
• Lifecycle timing: the November 2029 mainstream end date and the November 2034 extended end date mean planned upgrade windows that should appear in a multi-year cost model.
• Adjacent tooling: monitoring, backup and management tools for Windows are separate line items to price, and so are the administrators who run them.

Ask Microsoft and your reseller for a written licensing position that covers domain controllers, hosts, users and devices, along with the upgrade path past the 2029 mainstream end date.

The two directories have different license shapes, so a fair comparison needs the same questions answered for each. Software fees are only one component of total cost. Ask every vendor, reseller and implementation partner to split one-time work from recurring items, and to state who is paid for each. A written scope makes these answers comparable.

• One-time work: design, account and policy migration, certificate authority setup and testing are typically one-time costs. Ask for each as a separate line.
• Recurring items: operating system or Windows Server entitlements, client access licenses, support contracts and staff time for patching and upgrades recur every year.
• Cost drivers: the number of identities, domain controllers and sites, the scope of any cross-forest trust, and how many Linux or Windows hosts join the directory all move the cost up or down.
• Written scope: DeployOpen agrees scope, deliverables and timelines in writing before work starts, and a quote follows from that scope. Ask any partner to do the same.

Ask for every quote to state one-time and recurring costs separately, and to name the license terms it depends on.

When most endpoints and servers run Linux, FreeIPA uses the protocols those systems already speak. Enrollment places a host in the realm, issues it a Kerberos host principal and Kerberos-based single sign-on works through the MIT Kerberos KDC, while LDAP serves account lookups, sudo rules, SSH public keys and host-based access control. FreeIPA's built-in Dogtag certificate authority can issue host and service certificates without a separate PKI product.

• Enrollment model: Hosts join with the ipa-client-install tooling, which configures SSSD, Kerberos and certificate settings in one pass.
• Policy: Host-based access control, sudo rules and automount maps are managed centrally rather than file by file on each host.
• Credentials: Kerberos tickets let users reach SSH, NFS and internal services without repeated password prompts.
• Certificates: The built-in CA covers service certificates for Linux workloads, which reduces dependence on an outside PKI for internal hosts.
• Operating system support: FreeIPA is packaged in Fedora, Debian and CentOS and in Red Hat Enterprise Linux as Identity Management, so confirm which distribution and version your fleet runs.

Confirm with your platform team which distributions, SSSD versions and configuration management tools will enroll hosts, and whether any appliances need LDAP-only access that Kerberos cannot serve.

When most endpoints are Windows clients and users sign in with Windows accounts, Active Directory Domain Services is the directory those clients expect. Domain-joined Windows machines authenticate against domain controllers, receive Group Policy and apply configuration through the same directory, and rely on the schema and global catalog that Active Directory provides. Replication to every domain controller in the domain is part of how this model works.

• Domain join: Windows clients join the domain and receive machine and user policy through Group Policy objects.
• Policy depth: Group Policy is the native control plane for Windows settings, so administrators already run it for desktops and servers.
• Schema and objects: Users, computers and other objects live in one replicated directory that Windows services query directly.
• Operational fit: Teams with Windows Server skills can run AD DS without learning a second directory model.
• Lifecycle: Windows Server 2025 became available on November 1, 2024, with mainstream support ending November 14, 2029, so plan upgrades against Microsoft's lifecycle dates.

Confirm which Group Policy settings, Windows features and line-of-business applications depend on AD DS, since a Linux directory can authenticate Windows users only through a configured trust rather than by replacing domain join.

Many organizations run both Windows and Linux clients, and the question becomes which directory is authoritative for each population. FreeIPA can establish a cross-forest trust with an Active Directory domain on Windows Server 2008 R2 or later, so AD users can reach Linux resources such as SSH hosts and internal services without separate Linux accounts. The trust keeps Windows identities in Active Directory and lets Linux systems honor them through Kerberos.

• Trust direction: Confirm whether you need one-way or two-way trust, because access rules depend on which side authenticates users.
• Account ownership: Decide whether Windows users keep their Active Directory identity everywhere or whether Linux-only accounts exist for service and administrative use.
• Group mapping: Map AD groups to FreeIPA access rules explicitly, since group membership drives which Linux resources a user can reach.
• Name resolution and time: Trust setup depends on DNS and time synchronization between the two forests, so validate both before going live.
• Ownership of the trust: Agree in advance which team owns the trust, its renewal and the process for revoking access.

Confirm the trust configuration with your Active Directory and Linux administrators against the FreeIPA trust setup guide, and test it with a representative user, host and service before depending on it for production access.