Re: Kerberos userpassword storage

[Gémes Géza <geza@kzsdabas.hu>]

2010-08-04 10:30 keltezéssel, Howard Chu írta:
> Indexer wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Hi,
>>
>> Im attempting to use Kerberos as a password storage backend in my
>> ldap server.
>>
>> I have the server setup with its own principal of the form
>> ldap/domainname@REALM , and this keytab is in the KRB5_KTNAME
>> environment variable as slapd starts.
>>
>> I have put olcSaslRealm=REALM and olcSaslHost=kdc.domain into my
>> cn=config.
>>
>> Then, i have uid=user, where the userPassword attribute is
>> {KERBEROS}user@REALM
>
> Who told you to do that? There is no such password scheme in any
> OpenLDAP documentation.
>
>> When attempting to bind to this user, it seems to fail. When i reset
>> the password to a standard SSHA hash, it authenticates correctly. I
>> can authenticate with kerberos to the host that the ldap enabled
>> client, but i just cannot use ldap with the kerberos password backend.
>>
>> Any help in solving what else i need to do in this would be greatly
>> appreciated
>>
>> William Brown
>>
>> pgp.mit.edu
>
What about:
setting up saslauthd to authenticate against kerberos (e.g. command line
options -a kerberos5 -c -m /var/run/saslauthd)
and then slapd to use that (e.g. in /etc/ldap/sasl2/slapd.conf something
like:
pwcheck_method:    saslauthd
saslauthd_path:    /var/run/saslauthd/mux
), then specify the userPassword attribute as {SASL}user@REALM
?

Cheers

Geza Gemes