[Fedora-directory-users] Subject: SASL and gssapi

[Rich Megginson]

Thanks Noriko.  I've added a HowTo for this - 
http://directory.fedora.redhat.com/wiki/Howto:Kerberos

Noriko Hosoi wrote:

> Alastair Neil wrote:
>
>>
>> I would like to configure  the DS to use sasl and gssapi to 
>> authenticate against a local kerberos realm. 
>> I have been looking at the administrators guide and I'm a little 
>> confused. 
>> To enable SASL does one simply setup at least one mapping? 
>> An appropriate SASL mapping for gssapi combined with a ldap service 
>> principle plus saslauthd and the
>> cyrus-sasl-gssapi package should be all I need, correct?
>
> Yes, I believe so...  Also, I think your Directory Server should know 
> where the keytab is (if not in the default place)...
>
>     export KRB5_KTNAME=path_to_service_keytab; start-slapd
>
>> If someone could provide a gssapi sasl mapping example I would be 
>> grateful, I think I want to
>> map posix uid's to uid at REALM.EDU <mailto:uid at REALM.EDU>.
>
> Let's assume your entry in the DS has the DN "dn: 
> uid=uid,o=realm.edu".  Then, the map would be something like this (as 
> seen in "Introduction to SASL" in the Administrator's Guide):
>
> dn: cn=mapname,cn=mapping,cn=sasl,cn=config
> objectclass: top
> objectclass: nsSaslMapping
> cn: mapname
> nsSaslMapRegexString: (.*)@(.*)
> nsSaslMapBaseDNTemplate: uid=\1,o=\2
> nsSaslMapFilterTemplate: (objectclass=inetOrgPerson)
>
>
> Thanks,
> --noriko
>
>------------------------------------------------------------------------
>
>--
>Fedora-directory-users mailing list
>Fedora-directory-users at redhat.com
>https://www.redhat.com/mailman/listinfo/fedora-directory-users
>  
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/389-users/attachments/20050624/5754950f/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3312 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.fedoraproject.org/pipermail/389-users/attachments/20050624/5754950f/attachment.bin>