[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Kerberos and DIGEST-MD5



Jose Gonzalez Gomez <jgonzalez@opentechnet.com> writes:

[...]
>     So what's the problem? It seems that to build a LDAPv3 compliant
> server I must provide DIGEST-MD5 authentication to the LDAP server,
> and this is what I don't know how to achieve in a clean manner. In
> order to have DIGEST-MD5 working I must have a clear text password
> stored somewhere (correct me if I'm wrong), but it seems that Kerberos
> doesn't have it, or I don't know how to use it in the DIGEST-MD5
> authentication process. It seems that Cyrus SASL *does need* this
> password stored in its sasldb2 database to be able to successfully
> offer DIGEST-MD5, but this would mean that I'd have duplicated
> information and I'd have to sync both databases (Kerberos and SASL)
> whenever a password change occurs. So, am I missing anything here? Is
> there any clean solution for this?

You don't require sasldb2, but you may use attribute userPassword with
value in cleartext. Protection can be achieved by appropriate acl's.

-Dieter

-- 
Dieter Klünter | Systemberatung
Tel.: +49.40.64861967
Fax : +49.40.64891521
http://www.avci.de