[37246] in Kerberos
Re: syncing MIT Kerberos to Active Directory
daemon@ATHENA.MIT.EDU (Russ Allbery)
Mon Oct 5 16:26:33 2015
From: Russ Allbery <eagle@eyrie.org>
To: Tony Pugielli <tpugielli@tti-wireless.com>
In-Reply-To: <bbc0296fdd8b47d7b5265cc381399591@WEBMAIL.tti-wireless.com> (Tony
Pugielli's message of "Sun, 4 Oct 2015 15:30:36 +0000")
Date: Mon, 05 Oct 2015 13:26:09 -0700
Message-ID: <87mvvx3vvi.fsf@hope.eyrie.org>
MIME-Version: 1.0
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Tony Pugielli <tpugielli@tti-wireless.com> writes:
> Good day, I have an environment with MIT Kerberos and Active
> Directory. Is there a way to keep both databases (username and password)
> in sync? The use case is 802.1x authentication. EAP-GTC is not native to
> many devices so we want to use Active Directory so we can take advantage
> of the more widely native supplicant PEAP-MSCHAPV2. We would prefer the
> user only need to keep track of one username and password. Right now the
> Kerberos MIT database is widely used for their single sign-on
> applications.
You may find:
http://www.eyrie.org/~eagle/software/krb5-sync
useful, although it only does passwords. I believe there is a krb5-adsync
package somewhere based on that which also creates accounts.
--
Russ Allbery (eagle@eyrie.org) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
