Howard Chu wrote: >> Date: Thu, 12 Jun 2008 21:15:49 +0200 >> From: Jan Frode Myklebust<janfrode at tanso.net> > >> I have fds set up for user management, and have kerberos set >> up for authentication, but am a bit uncertain if I'm now finished, >> or if fds+kerberos are supposed to be better integrated. >> >> Is the normal procedure for managing users: >> >> - add user info to the directory (ldapadd) >> - create user principal (addprinc username) >> >> Or can the creation of user principal be automatically created >> from within fds when we create users there ? > > If you're using Heimdal's KDC there is a much less clumsy solution - > just configure your KDC to store its information in LDAP. Then you can > include the KDC-specific attributes in your lddapadd requests, and > manage both sets of users solely through LDAP. This works very well > with OpenLDAP; I think it should also work with FDS 1.1 now that > they've integrated ldapi:// support (but haven't tried it myself). You > can then also configure OpenLDAP to automatically synchronize password > changes between LDAP and Kerberos (since all the information is in the > LDAP entry). > > I believe recent versions of MIT Kerberos also offer this possibility, > but I haven't heard of any success stories with it so far. This is what freeipa provides - MIT Kerberos using Fedora DS as it's backend database, including password sync. -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3258 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20080613/fc878e97/attachment.bin
