We want regular 389-ds password changes to also update our MIT kerberos realm principals.

It’s my understanding that FreeIPA does this already via their ipa_pwd_extop 389-ds plugin.


Does anybody have any comment on the feasibility of implementing this plugin in a vanilla 389-ds install without bringing much of FreeIPA along with it?


Anybody have any better ideas? J



Anthony Winstanley

UBC Enterprise LDAP project