With Heimdal and OpenLDAP, you can use the smbk5pwd overlay (it's in the
contrib directory) to sync heimdal keys, openldap passwords (it actually
points the openldap password to the heimdal key), and sambaLA and
sambaNT hashes. Then, if you configure your client services to change
passwords using ldappasswd, you can avoid the long chain of custom
scripts to keep everything in sync.
If there is something similar for MIT Kerberos and FDS, I would be sold
Doesn't Samba 4 make this problem moot though?
Howard Chu wrote:
> Date: Thu, 12 Jun 2008 21:15:49 +0200
> From: Jan Frode Myklebust<janfrode(a)tanso.net>
> I have fds set up for user management, and have kerberos set
> up for authentication, but am a bit uncertain if I'm now finished,
> or if fds+kerberos are supposed to be better integrated.
> Is the normal procedure for managing users:
> - add user info to the directory (ldapadd)
> - create user principal (addprinc username)
> Or can the creation of user principal be automatically created
> from within fds when we create users there ?
If you're using Heimdal's KDC there is a much less clumsy solution -
just configure your KDC to store its information in LDAP. Then you can
include the KDC-specific attributes in your lddapadd requests, and
manage both sets of users solely through LDAP. This works very well
with OpenLDAP; I think it should also work with FDS 1.1 now that
they've integrated ldapi:// support (but haven't tried it myself). You
can then also configure OpenLDAP to automatically synchronize password
changes between LDAP and Kerberos (since all the information is in the
I believe recent versions of MIT Kerberos also offer this possibility,
but I haven't heard of any success stories with it so far.