Re: Kerberos + OpenLDAP help needed.

From: Nick Lopez (securityfocus_at_glowingmonkey.org)
Date: 09/23/03

  • Next message: Peter Mueller: "RE: Linux and firewall load balancing" 
    Date: Tue, 23 Sep 2003 11:18:05 -0700
To: focus-linux@securityfocus.com

    On Thu, Sep 18, 2003 at 12:08:35PM +0200, Andrew Cooks wrote:
    > Has anyone on the list played/worked with Kerberos + LDAP before?
    >
    > I'm trying to setup Samba 3 + OpenLDAP + Kerberos, but I can't figure out
    > the exact relationship between the OpenLDAP db and Kerberos db.
      Use OpenLDAP to store the information you care about. All Kerberos does
    is provide authentication, aka, prove they are who they say they are. Krb
    stores the passwords and makes sure they never travel across the wire.

      With OpenLDAP you can add the krb5Principal objectclass and a
    krb5PrincipalName attribute to your users to allow them to use the
    credentials they get from Kerberos to bind to the tree and change stuff.
    Note this is not the krb password, but a krb ticket. If you want to allow
    people to bind to the tree with their passwords directly you need to set
    their password to something like {KRB5}principal@REALM and I belive OpenLDAP
    will do the run around to verify their password agains't kerberos. This is
    highly discouraged as it breaks the Kerberos ideal of never sending the
    password over the wire, even encrypted.

      Oh, yeah, the ldap server will need a principle too, ldap/hostname,
    stored in a keytab.

      Confused yet?

    > I've read all the (Mit) Kerberos V docs, official Samba3 docs and most of
    > the OpenLDAP docs, as well as plenty of googling.
      Been there, done that. They suck don't they? I found this one the most
    useful, but still not quite up to date.
    http://www.bayour.com/LDAPv3-HOWTO.html. The bug in the Debian SASL package
    is still there, but the syntax he gives for Krb ACL entries is off.
    "by dn="uid=USERNAME.*\*realm=REALM" write" works for me with OpenLDAP 2.1.

      - Nick Lopez
        spamtrap@glowingmonkey.org

      -- Randomly selected signature --
    < ket> My country tis a freak, sweet land of anarchy, of thee I scream.

  • Next message: Peter Mueller: "RE: Linux and firewall load balancing"

    Relevant Pages