[Fedora-directory-users] pass-thru questions

[Richard Megginson]

MJD Shopping Account wrote:
> I'm reading with interest the many recent articles on the PAM passthru plugin.  I'm hoping to implement it here and have a few questions.
>
> Do you have to add the dn: entry (example in the plugin README) by way of editing the dse.ldif, or can it also be added via an 'ldapadd -f <file>.ldif' command?
>   
Either way is ok.  But you still have to restart the server after adding 
the entry.
> How does use of this plugin relate to setting the userPassword attribute to something like '{KERBEROS}user at REALM'?  Is that a completely separate method for using kerberos?
Yes.  It is completely different and doesn't use a special userPassword 
value.
> The default suggested setup is with pamIDMapMethod = RDN, so this should map to 'uid' for my users.  I assume with pamFallback = FALSE that the userPassword attribute never gets used?
>   
Correct.
> I'm hoping to test the basic setup, but will eventually need to support users in different KerberosV realms.  I am imagining in that case that I should use pamIDMapMethod = ENTRY with pamIDAttr set appropriately and filled with the full userprinciple name, ie user at REALM not just user.  Yes?
>   
Yes.
> Last time I used PADL's MigrateTools scripts to parse flat passwd files into ldif files for user entries, it had the ability to add an attribute to a person's entry with these attributes:
>   objectClass: kerberosSecurityObject
>   krbName: user at realm
> This seems like a good candidate for the pamIDAttr value; I didn't use it at the time because I would need to find the right schema file to support this attribute.  Any ideas where to find this?  Once found, I assume it goes in serverroot/slapd-instance/config/schema, what would I call the file however?  I don't know what the numbering on the filenames indicates.
>   
The numbering indicates the order in which it is loaded - 00 is first, 
99 is last.  Most of the schema shipped with the server is in the range 
00-50.  I suggest you use 60krb5.ldif or something like that.
> My setup: I'm testing on a FDS 1.0.4 install runing on RedHat 4; I am part of a network that uses Active Directory for Window authentication, and I can use pam_krb5.so in my PAM setup as long as I'm using only one realm.  I think this passthrough module is a good match for what I need, if it gets me the cross-realm capability by way of the pamIDAttr.  I do NOT think I can use straight SASL mapping to do this, because I do not have sufficient privileges to add the ldap server to the AD domain, so I can't get the ldap/<server>@rREALM principle into place in AD.
>   
SASL mapping should work for SASL BINDs.  The PAM passthru plugin should 
only be used in those cases where you have a client that only supports 
simple (i.e. username/password) BIND.
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3178 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.fedoraproject.org/pipermail/389-users/attachments/20061121/db176775/attachment.bin>