Re: Password-less operation

[Buchan Milne <bgmilne@staff.telkomsa.net>]

On Wednesday, 8 February 2012 01:22:33 Jean-Luc Wasmer wrote:
> Hi,
> 
> The user db on my system is stored in LDAP and integrated with PAM and NSS.
> The LDAP db also contain address book data for each user. I would like to
> be able to call ldap utilities (e.g. ldapsearch) without having the user
> to enter his/her password everytime. I would also like for scripts running
> as those users to have access to the respective LDAP entries. I noticed
> ldapsearch supports SASL binds, so I was wondering if that could be used
> in conjunction with Kerberos to accomplish my goal

Yes.

> (from what I
> understand, the kinit command would have to be called before ldapsearch).

You would need to have a TGT. In a Kerberos environment, you should normally 
have things in place to ensure this (e.g. pam_krb5 for auth and session would 
accomplish getting an initial TGT on a login session).

> Is there any other way to do this?

There are other SASL mechs that may be of use, but also require other 
infrastructure or credential distribution. Kerberos/GSSAPI has other 
advantages as well, due to wide support/adoption.

Regards,
Buchan