[29413] in Kerberos
Re: OpenLDAP to Kerberos, Take 2
daemon@ATHENA.MIT.EDU (paul)
Tue Mar 4 14:31:16 2008
To: kerberos@mit.edu
From: paul <paul@subsignal.org>
Date: Tue, 04 Mar 2008 10:44:36 +0100
Message-ID: <fqj5m3$52r$1@ger.gmane.org>
Mime-Version: 1.0
X-Complaints-To: usenet@ger.gmane.org
In-Reply-To: <47C88A19.8070003@ucsc.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Wes Modes schrieb:
>>> But on an OpenLDAP list I got:
>>>
>>> There is an ugly hack: having a userPassword field with
>>> "{SASL}<Kerberos principal>" in LDAP you can employ saslauthd's
>>> Kerberos backend. We use it as a crutch for a web application which
>>> can only authenticate against an LDAP directory
>>>
>> And what that does is exactly what's described above: it causes slapd to
>> take the username and password and do a kinit and ticket verification.
>> (What it actually does is hand the username and password off to saslauthd,
>> which then does that, but for your purposes it amounts to the same thing.)
>>
> Where does one get more info on this ugly hack?
>
> What you described is precisely what I was hoping for. However, I hoped
> it would be commonplace and elegant. But ugly hacks have their place.
Hi,
before going down this route you might investigate adding SASL GSSAPI to
smbldap-tools. I took a quick look at the source code and it seems
straightforward to add Authen::SASL bind capabilities.
You need to find out if you have access to a ticket when the script is
called thought. You might ask the samba folks here...
cheers
Paul
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
