Just to be clear I will list all Centrify Express limitations (off the top of my head) so you understand beforehand if this is a worthy effort:
- You can't use the auto.schema* parameters or overrides
- You can't manage UNIX identity (it's generated for you)
- You can't manage who's visible or not to a UNIX, Linux or Mac System
- You can't manage NIS Maps in AD
- You can't manage local users
- You can't use the proxies (ldap and NIS proxies)
- You can't authenticate users on the trusting side of a 1-way trust.
- You don't get Report Services that aid for attestation
- You are limited by the EULA to deploy in 200 systems max
- You don't get shared password management or secure access services
- You don't get access to HP-UX or versions of older clients
- You can't use group policy for configuration management
- Your support is limited to the community in the latest version only (we do releases for the client 2 or 3 times a year
The recommended best practice is to use Centrify Infrastructure Services (licensed version) to eliminate all the limitations above, plus enhance management with Centrify Zones and DirectAuthorize.
If you are a commercial customer and are looking into parameter-based access control, although simple and straightforward, implies that you must maintain them and implement a secondary mechanism to implement attestation if this is required in your organization.
Bottomline, if you are a commercial organization, we encourage you to go for Infrastructure Services (Server Suite) because once you face some standard enterprise use cases, you suddenly graduate from Express and need something more flexible and feature rich.
The whole idea behind this post is to save you time. Note that you can request an evaluation of Infrastructure Services using the contact page.
R.P