Scott Grizzard wrote: > With Heimdal and OpenLDAP, you can use the smbk5pwd overlay (it's in the > contrib directory) to sync heimdal keys, openldap passwords (it actually > points the openldap password to the heimdal key), and sambaLA and > sambaNT hashes. Then, if you configure your client services to change > passwords using ldappasswd, you can avoid the long chain of custom > scripts to keep everything in sync. > > If there is something similar for MIT Kerberos and FDS, I would be sold > in microsecond. The freeIPA password plugin does that if the entry has the objectclass sambaSamAccount in it. > Doesn't Samba 4 make this problem moot though? > > - Scott > > Howard Chu wrote: >>> Date: Thu, 12 Jun 2008 21:15:49 +0200 >>> From: Jan Frode Myklebust<janfrode at tanso.net> >> >>> I have fds set up for user management, and have kerberos set >>> up for authentication, but am a bit uncertain if I'm now finished, >>> or if fds+kerberos are supposed to be better integrated. >>> >>> Is the normal procedure for managing users: >>> >>> - add user info to the directory (ldapadd) >>> - create user principal (addprinc username) >>> >>> Or can the creation of user principal be automatically created >>> from within fds when we create users there ? >> >> If you're using Heimdal's KDC there is a much less clumsy solution - >> just configure your KDC to store its information in LDAP. Then you can >> include the KDC-specific attributes in your lddapadd requests, and >> manage both sets of users solely through LDAP. This works very well >> with OpenLDAP; I think it should also work with FDS 1.1 now that >> they've integrated ldapi:// support (but haven't tried it myself). You >> can then also configure OpenLDAP to automatically synchronize password >> changes between LDAP and Kerberos (since all the information is in the >> LDAP entry). >> >> I believe recent versions of MIT Kerberos also offer this possibility, >> but I haven't heard of any success stories with it so far. > > -- > Fedora-directory-users mailing list > Fedora-directory-users at redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3245 bytes Desc: S/MIME Cryptographic Signature Url : http://lists.fedoraproject.org/pipermail/389-users/attachments/20080613/1738e623/attachment.bin
