[Fedora-directory-users] adding an attribute, howto?

[MJD Shop Account]

I would like to use the pam_passthru plugin to use kerberos  
authentication via pam_krb5, but am running into a few issues.  I  
need to specify an attribute to use, as I have multiple realms--my  
uid is just a login name, for the kerberos to work I need  
<uid>@<realm>.  I wasn't sure what to use for the attribute, and was  
thinking of hijacking the 'description' attribute for this purpose.   
However another posting to this list gave me the idea of just  
extending the schema with an additional attribute in 99user.ldif.  I  
would likely want to copy the definition for 'uid' from, say class  
posixaccount, but rename it to krb5uid or something.  Can anyone  
point me to detailed instructions?  Is this trivial or difficult?  I  
looked at the current schema files and was not sure what I wold need  
to copy to make it work, and how to add the new attribute explicitly  
to the class schema as an optional attribute.

What are the consequences of adding such an attribute when  
replication is occurring?  I assume I must extend the schema on each  
server, what happens if I neglect to extend the schema on one server  
and it receives replica info that has this new attribute populated  
for some users?

I would also entertain the idea of having an attribute with just the  
realm (or a proxy for the realm), and constructing the krbuid  
equivalent via some operational attribute that constructs it via uid  
+ "@" + realm on the fly, if this is possible.  I might even be able  
to do this using existing location attribute or another existing  
attribute, I can easily  determine the correct realm from  
corresponding location-specific info associated with each user.  But,  
I don't know how to do this in practice.

Also, if anyone has an example pam ldapserver file they could share,  
I would appreciate it.

-Marty


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/389-users/attachments/20061220/2504a137/attachment.html>