<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Luke Howard wrote:
<blockquote cite="mid200507171224.j6HCODHn078960@au.padl.com"
type="cite">
<blockquote type="cite">
<pre wrap="">There is a "ldap backend" for Heimdal, but it uses the non-standard ldapi interface (e.g. LDAP through a unix domain file based socket rather than a
TCP/IP socket). You would have to port that code to use an ldap or ldaps interface for use with FDS.
</pre>
</blockquote>
<pre wrap=""><!---->
That's not hard to change, but I would prefer to see someone add ldapi://
to FDS :-)
</pre>
</blockquote>
It's on our wishlist.<br>
<blockquote cite="mid200507171224.j6HCODHn078960@au.padl.com"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Otherwise, I'm not sure if GSSAPI supports a password change mechanism. If so, you could do this through FDS.
</pre>
</blockquote>
<pre wrap=""><!---->
GSS-API does not deal with acquiring initial credentials or changing
passwords. In order to maintain password synchronization, you need to
ensure that the set of Kerberos keys and directory user passwords is
kept synchronized.
</pre>
</blockquote>
Ok. That's what I thought.<br>
<blockquote cite="mid200507171224.j6HCODHn078960@au.padl.com"
type="cite">
<pre wrap="">
In our XAD identity server, we have a SLAPI plugin that intercepts
LDAP password change requests (either RFC 3062, NMAS,</pre>
</blockquote>
What's NMAS?<br>
<blockquote cite="mid200507171224.j6HCODHn078960@au.padl.com"
type="cite">
<pre wrap="">or LDAP updates
of the userPassword/unicodePwd attributes) and generates a user's key
set for Kerberos, Digest, etc. I believe Symas wrote a similar plugin
that works with the Heimdal LDAP backend but I'm not sure whether it
is generally available.
</pre>
</blockquote>
Symas has a few extensions that are not available (yet?) with OpenLDAP.<br>
<blockquote cite="mid200507171224.j6HCODHn078960@au.padl.com"
type="cite">
<pre wrap="">
-- Luke
--
--
Fedora-directory-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Fedora-directory-users@redhat.com">Fedora-directory-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/fedora-directory-users">https://www.redhat.com/mailman/listinfo/fedora-directory-users</a>
</pre>
</blockquote>
</body>
</html>