<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
David Boreham wrote:
<blockquote cite="mid43145667.2050701@boreham.org" type="cite">
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<br>
<blockquote cite="mid1125380249.7982.96.camel@localhost.localdomain"
type="cite">
<pre wrap=""><!---->
Hmm... What I'm trying to accomplish here is a configuration where users
authenticate to the ldap server with username/password (no kerberos
ticket) and their password is checked from kerberos. Is this possible
to do with the standard plugins? I've had a hard time trying to figure
out how to do this... =) The idea in this is that we'd like to have
a single service for authenticating users, even for services that do not
support kerberos.
</pre>
</blockquote>
This isn't supported in the current code.<br>
</blockquote>
If you just want to do LDAP SIMPLE BINDs with username/password
(hopefully over a TLS connection), and use the Kerberos password
instead of the userPassword attribute, you can use the PAM passthru
bind plugin. You will have to grab the Fedora DS source and build it.
What this does is pass the BIND authentication request to PAM, which
you can configure to go to Kerberos for authentication.<br>
<blockquote cite="mid43145667.2050701@boreham.org" type="cite">
<blockquote cite="mid1125380249.7982.96.camel@localhost.localdomain"
type="cite">
<pre wrap="">If it's not possible, I'll look into writing a plugin that does this.
</pre>
</blockquote>
Sounds good. First you'd need to figure out how to perform a proxied
authentiation<br>
against kerberos. With the existing SASL/GSSAPI mechanism we don't need
to do <br>
that because we're simply passing through the authentication payload
between GSSAPI<br>
and the client. Presumably you'd need to do whatever 'kinit' does, but
inside the DS.<br>
<br>
<br>
<pre wrap="">
<hr size="4" width="90%">
--
Fedora-directory-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Fedora-directory-users@redhat.com">Fedora-directory-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/fedora-directory-users">https://www.redhat.com/mailman/listinfo/fedora-directory-users</a>
</pre>
</blockquote>
</body>
</html>