Date: Thu, 12 Jun 2008 21:15:49 +0200
From: Jan Frode Myklebust<janfrode(a)tanso.net>
I have fds set up for user management, and have kerberos set
up for authentication, but am a bit uncertain if I'm now finished,
or if fds+kerberos are supposed to be better integrated.
Is the normal procedure for managing users:
- add user info to the directory (ldapadd)
- create user principal (addprinc username)
Or can the creation of user principal be automatically created
from within fds when we create users there ?
If you're using Heimdal's KDC there is a much less clumsy solution - just
configure your KDC to store its information in LDAP. Then you can include the
KDC-specific attributes in your lddapadd requests, and manage both sets of
users solely through LDAP. This works very well with OpenLDAP; I think it
should also work with FDS 1.1 now that they've integrated ldapi:// support
(but haven't tried it myself). You can then also configure OpenLDAP to
automatically synchronize password changes between LDAP and Kerberos (since
all the information is in the LDAP entry).
I believe recent versions of MIT Kerberos also offer this possibility, but I
haven't heard of any success stories with it so far.
--
-- Howard Chu
CTO, Symas Corp.
http://www.symas.com
Director, Highland Sun
http://highlandsun.com/hyc/
Chief Architect, OpenLDAP
http://www.openldap.org/project/