[Fedora-directory-users] SASL/Kerberos5 question

[Michał Droździewicz]

Hello,
I'm fairly new to the FDS (one week maybe). Earlier I've been using
OpenLDAP and now I want to migrate from OL to FDS. Everything looks
great (schema conversion and ldif transfer) but I have one problem. Old
setup was constructed more or less that the passwords weren't stored in
LDAP but in Kerberos and in 'userPassword' field in clear text was
'uid(a)REALM.INT'
Now when using FDS I can't find any configuration option, that would
make it possible to use Kerberos for storing passwords and still to use
FDS to authenticate user. Maybe SASL Mappings are for that and you only
have to configure them right. Is there anyone who knows how to do it?
Thanks in advance.

-- 
email/xmpp: koniczynek(a)uaznia.net

[Rich Megginson]

koniczynek wrote:
>  Hello,
>  I'm fairly new to the FDS (one week maybe). Earlier I've been using
>  OpenLDAP and now I want to migrate from OL to FDS. Everything looks
>  great (schema conversion and ldif transfer) but I have one problem. Old
>  setup was constructed more or less that the passwords weren't stored in
>  LDAP but in Kerberos and in 'userPassword' field in clear text was
>  'uid(a)REALM.INT'
>  Now when using FDS I can't find any configuration option, that would
>  make it possible to use Kerberos for storing passwords and still to use
>  FDS to authenticate user. Maybe SASL Mappings are for that and you only
>  have to configure them right. 
Right.  For clients that can do SASL/GSSAPI BIND
(i.e. Kerberos), you 
just need to configure the SASL Mapping to find the user's DN based on 
the Kerberos principal.

For clients that cannot use SASL but must use simple username/password 
bind, you can use the PAM passthrough plug-in.
>  Is there anyone who knows how to do it?
>  Thanks in advance.
>
>

[Michał Droździewicz]

Richard Megginson, dnia 2006-11-17 21:29 napisal:
>  Right.  For clients that can do SASL/GSSAPI BIND (i.e. Kerberos),
> you
>  just need to configure the SASL Mapping to find the user's DN based on
>  the Kerberos principal. 
My company runs a lot of software which can't use
SASL/GSSAPI BIND, so
this is definitely not for me.

>  For clients that cannot use SASL but must use simple
> username/password
>  bind, you can use the PAM passthrough plug-in. 
OK, where I can read about that? Doc
and wiki seems to have no PAM in
them. And is this equal to what I have configured with OpenLDAP? Because
when migrating, FDS should support old authentication method (with
'uid(a)REALM.NET' in the 'userPassword' field and passwords in Kerberos).

-- 
email/xmpp: koniczynek(a)uaznia.net

[Michał Droździewicz]

koniczynek napisał(a):
>  OK, where I can read about that? Doc and wiki seems to have no PAM
> in
>  them. And is this equal to what I have configured with OpenLDAP? Because
>  when migrating, FDS should support old authentication method (with
>  'uid(a)REALM.NET' in the 'userPassword' field and passwords in Kerberos).
ok, maybe this will give someone a clue on what do I need to configure. 
In my OpenLDAP configuration file (slapd.conf) I have the following lines:

sasl-realm COMPANY.INT
sasl_realm COMPANY.INT
sasl-host ldap.company.int
sasl_host ldap.company.int

and in the 'userPassword' field is what I mentioned above. Could anybody 
help me?

-- 
xmpp/email: koniczynek(a)uaznia.net
xmpp/email: koniczynek(a)gmail.com

[Michał Droździewicz]

koniczynek napisał(a):
>  koniczynek napisał(a):
> > OK, where I can read about that? Doc and wiki seems to have no PAM in
> > them. And is this equal to what I have configured with OpenLDAP? Because
> > when migrating, FDS should support old authentication method (with
> > 'uid(a)REALM.NET' in the 'userPassword' field and passwords in
> Kerberos).
>  ok, maybe this will give someone a clue on what do I need to configure. 
>  In my OpenLDAP configuration file (slapd.conf) I have the following lines:
>  
>  sasl-realm COMPANY.INT
>  sasl_realm COMPANY.INT
>  sasl-host ldap.company.int
>  sasl_host ldap.company.int
>  
>  and in the 'userPassword' field is what I mentioned above. Could anybody 
>  help me? 
As somebody earlier mentioned PAM pass through plugin is the best way to 
accomplish this. And for people, who are looking for documentation for 
this plugin, it can be found in the README in the plugin source 
directory (in fedora directory server 1.0.4 for example).

-- 
koniczynek

[Rich Megginson]

koniczynek wrote:
>  koniczynek napisał(a):
> > koniczynek napisał(a):
> >> OK, where I can read about that? Doc and wiki seems to have no PAM in
> >> them. And is this equal to what I have configured with OpenLDAP? 
> >> Because
> >> when migrating, FDS should support old authentication method (with
> >> 'uid(a)REALM.NET' in the 'userPassword' field and passwords in
> Kerberos).
> > ok, maybe this will give someone a clue on what do I need to 
> > configure. In my OpenLDAP configuration file (slapd.conf) I have the 
> > following lines:
> >
> > sasl-realm COMPANY.INT
> > sasl_realm COMPANY.INT
> > sasl-host ldap.company.int
> > sasl_host ldap.company.int
> >
> > and in the 'userPassword' field is what I mentioned above. Could 
> > anybody help me?
>  As somebody earlier mentioned PAM pass through plugin is the best way 
>  to accomplish this. And for people, who are looking for documentation 
>  for this plugin, it can be found in the README in the plugin source 
>  directory (in fedora directory server 1.0.4 for example). 
And now that the server
is back up, in cvs.fedora.redhat.com:

README - 
http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/servers/plugins/pam_...
config.ldif - 
http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/servers/plugins/pam_...

[Michał Droździewicz]

Richard Megginson napisał(a):
> > As somebody earlier mentioned PAM pass through plugin is the best
> way 
> > to accomplish this. And for people, who are looking for documentation 
> > for this plugin, it can be found in the README in the plugin source 
> > directory (in fedora directory server 1.0.4 for example).
>  And now that the server is back up, in cvs.fedora.redhat.com:
>  README - 
>
> http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/servers/plugins/pam_...
>
>  config.ldif - 
>
> http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/servers/plugins/pam_...
>  
Yes, now it's possible, but yesterday it wasn't ;)

-- 
koniczynek