Thanks Noriko. I've added a HowTo for this - http://directory.fedora.redhat.com/wiki/Howto:Kerberos Noriko Hosoi wrote: > Alastair Neil wrote: > >> >> I would like to configure the DS to use sasl and gssapi to >> authenticate against a local kerberos realm. >> I have been looking at the administrators guide and I'm a little >> confused. >> To enable SASL does one simply setup at least one mapping? >> An appropriate SASL mapping for gssapi combined with a ldap service >> principle plus saslauthd and the >> cyrus-sasl-gssapi package should be all I need, correct? > > Yes, I believe so... Also, I think your Directory Server should know > where the keytab is (if not in the default place)... > > export KRB5_KTNAME=path_to_service_keytab; start-slapd > >> If someone could provide a gssapi sasl mapping example I would be >> grateful, I think I want to >> map posix uid's to uid at REALM.EDU <mailto:uid at REALM.EDU>. > > Let's assume your entry in the DS has the DN "dn: > uid=uid,o=realm.edu". Then, the map would be something like this (as > seen in "Introduction to SASL" in the Administrator's Guide): > > dn: cn=mapname,cn=mapping,cn=sasl,cn=config > objectclass: top > objectclass: nsSaslMapping > cn: mapname > nsSaslMapRegexString: (.*)@(.*) > nsSaslMapBaseDNTemplate: uid=\1,o=\2 > nsSaslMapFilterTemplate: (objectclass=inetOrgPerson) > > > Thanks, > --noriko > >------------------------------------------------------------------------ > >-- >Fedora-directory-users mailing list >Fedora-directory-users at redhat.com >https://www.redhat.com/mailman/listinfo/fedora-directory-users > > -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.fedoraproject.org/pipermail/389-users/attachments/20050624/5754950f/attachment.html -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3312 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20050624/5754950f/attachment.bin
