Re: fds + kerberos

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Scott Grizzard wrote:
> With Heimdal and OpenLDAP, you can use the smbk5pwd overlay (it's in the 
> contrib directory) to sync heimdal keys, openldap passwords (it actually 
> points the openldap password to the heimdal key), and sambaLA and 
> sambaNT hashes.  Then, if you configure your client services to change 
> passwords using ldappasswd, you can avoid the long chain of custom 
> scripts to keep everything in sync.
> 
> If there is something similar for MIT Kerberos and FDS, I would be sold 
> in microsecond.

The freeIPA password plugin does that if the entry has the objectclass 
sambaSamAccount in it.

> Doesn't Samba 4 make this problem moot though?
> 
> - Scott
> 
> Howard Chu wrote:
>>> Date: Thu, 12 Jun 2008 21:15:49 +0200
>>> From: Jan Frode Myklebust<janfrode at tanso.net>
>>
>>> I have fds set up for user management, and have kerberos set
>>> up for authentication, but am a bit uncertain if I'm now finished,
>>> or if fds+kerberos are supposed to be better integrated.
>>>
>>> Is the normal procedure for managing users:
>>>
>>>     - add user info to the directory (ldapadd)
>>>     - create user principal (addprinc username)
>>>
>>> Or can the creation of user principal be automatically created
>>> from within fds when we create users there ?
>>
>> If you're using Heimdal's KDC there is a much less clumsy solution - 
>> just configure your KDC to store its information in LDAP. Then you can 
>> include the KDC-specific attributes in your lddapadd requests, and 
>> manage both sets of users solely through LDAP. This works very well 
>> with OpenLDAP; I think it should also work with FDS 1.1 now that 
>> they've integrated ldapi:// support (but haven't tried it myself). You 
>> can then also configure OpenLDAP to automatically synchronize password 
>> changes between LDAP and Kerberos (since all the information is in the 
>> LDAP entry).
>>
>> I believe recent versions of MIT Kerberos also offer this possibility, 
>> but I haven't heard of any success stories with it so far.
> 
> -- 
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20080613/1738e623/attachment.bin 


[Index of Archives]     [Fedora User Discussion]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [Fedora News]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Maintainers]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Legacy]     [Fedora Desktop]     [Fedora Fonts]     [ATA RAID]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Centos]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora QA]     [Fedora Triage]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Tux]     [Yosemite News]     [Yosemite Photos]     [Linux Apps]     [Maemo Users]     [Gnome Users]     [KDE Users]     [Fedora Tools]     [Fedora Art]     [Fedora Docs]     [Maemo Users]     [Asterisk PBX]     [Fedora Sparc]     [Fedora Universal Network Connector]     [Fedora ARM]

  Powered by Linux