[Fedora-directory-users] Re: fds + kerberos

[Rich Megginson]

Howard Chu wrote:
>> Date: Thu, 12 Jun 2008 21:15:49 +0200
>> From: Jan Frode Myklebust<janfrode at tanso.net>
>
>> I have fds set up for user management, and have kerberos set
>> up for authentication, but am a bit uncertain if I'm now finished,
>> or if fds+kerberos are supposed to be better integrated.
>>
>> Is the normal procedure for managing users:
>>
>>     - add user info to the directory (ldapadd)
>>     - create user principal (addprinc username)
>>
>> Or can the creation of user principal be automatically created
>> from within fds when we create users there ?
>
> If you're using Heimdal's KDC there is a much less clumsy solution - 
> just configure your KDC to store its information in LDAP. Then you can 
> include the KDC-specific attributes in your lddapadd requests, and 
> manage both sets of users solely through LDAP. This works very well 
> with OpenLDAP; I think it should also work with FDS 1.1 now that 
> they've integrated ldapi:// support (but haven't tried it myself). You 
> can then also configure OpenLDAP to automatically synchronize password 
> changes between LDAP and Kerberos (since all the information is in the 
> LDAP entry).
>
> I believe recent versions of MIT Kerberos also offer this possibility, 
> but I haven't heard of any success stories with it so far.
This is what freeipa provides - MIT Kerberos using Fedora DS as it's 
backend database, including password sync.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3258 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.fedoraproject.org/pipermail/389-users/attachments/20080613/fc878e97/attachment.bin>