MJD Shop Account wrote:
I would like to use the pam_passthru plugin to use kerberos authentication via pam_krb5, but am running into a few issues. I need to specify an attribute to use, as I have multiple realms--my uid is just a login name, for the kerberos to work I need <uid>@<realm>. I wasn't sure what to use for the attribute, and was thinking of hijacking the 'description' attribute for this purpose. However another posting to this list gave me the idea of just extending the schema with an additional attribute in 99user.ldif. I would likely want to copy the definition for 'uid' from, say class posixaccount, but rename it to krb5uid or something. Can anyone point me to detailed instructions? Is this trivial or difficult? I looked at the current schema files and was not sure what I wold need to copy to make it work, and how to add the new attribute explicitly to the class schema as an optional attribute.It's not that difficult to create your own attribute. The hardest thing is creating your own OID. If you just try to copy the definition of uid without creating a unique OID, you will get lots of errors.
Once you do that, you can just add your new attribute using ldapmodify. Not only will this add your new attribute type to 99user.ldif, but it will also ensure that it will be replicated.
You should then create your own AUXILIARY objectclass that has your new attribute type as an allowed attribute, and add this objectclass to all users that you want to add the attribute to. Also add your objectclass definition using ldapmodify to ensure it is replicated properly.
What are the consequences of adding such an attribute when replication is occurring? I assume I must extend the schema on each server, what happens if I neglect to extend the schema on one server and it receives replica info that has this new attribute populated for some users?
Schema replication happens before data replication.
This is not really possible. I suppose the right way to do this would be to extend the SASL mapping code to be used by pam passthrough.I would also entertain the idea of having an attribute with just the realm (or a proxy for the realm), and constructing the krbuid equivalent via some operational attribute that constructs it via uid + "@" + realm on the fly, if this is possible. I might even be able to do this using existing location attribute or another existing attribute, I can easily determine the correct realm from corresponding location-specific info associated with each user. But, I don't know how to do this in practice.
Also, if anyone has an example pam ldapserver file they could share, I would appreciate it.-Marty ------------------------------------------------------------------------ -- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
-- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users
