Hello, I'm fairly new to the FDS (one week maybe). Earlier I've been using OpenLDAP and now I want to migrate from OL to FDS. Everything looks great (schema conversion and ldif transfer) but I have one problem. Old setup was constructed more or less that the passwords weren't stored in LDAP but in Kerberos and in 'userPassword' field in clear text was 'uid@REALM.INT' Now when using FDS I can't find any configuration option, that would make it possible to use Kerberos for storing passwords and still to use FDS to authenticate user. Maybe SASL Mappings are for that and you only have to configure them right. Is there anyone who knows how to do it? Thanks in advance.
koniczynek wrote:
Hello, I'm fairly new to the FDS (one week maybe). Earlier I've been using OpenLDAP and now I want to migrate from OL to FDS. Everything looks great (schema conversion and ldif transfer) but I have one problem. Old setup was constructed more or less that the passwords weren't stored in LDAP but in Kerberos and in 'userPassword' field in clear text was 'uid@REALM.INT' Now when using FDS I can't find any configuration option, that would make it possible to use Kerberos for storing passwords and still to use FDS to authenticate user. Maybe SASL Mappings are for that and you only have to configure them right.
Right. For clients that can do SASL/GSSAPI BIND (i.e. Kerberos), you just need to configure the SASL Mapping to find the user's DN based on the Kerberos principal.
For clients that cannot use SASL but must use simple username/password bind, you can use the PAM passthrough plug-in.
Is there anyone who knows how to do it? Thanks in advance.
Richard Megginson, dnia 2006-11-17 21:29 napisal:
Right. For clients that can do SASL/GSSAPI BIND (i.e. Kerberos), you just need to configure the SASL Mapping to find the user's DN based on the Kerberos principal.
My company runs a lot of software which can't use SASL/GSSAPI BIND, so this is definitely not for me.
For clients that cannot use SASL but must use simple username/password bind, you can use the PAM passthrough plug-in.
OK, where I can read about that? Doc and wiki seems to have no PAM in them. And is this equal to what I have configured with OpenLDAP? Because when migrating, FDS should support old authentication method (with 'uid@REALM.NET' in the 'userPassword' field and passwords in Kerberos).
koniczynek napisał(a):
OK, where I can read about that? Doc and wiki seems to have no PAM in them. And is this equal to what I have configured with OpenLDAP? Because when migrating, FDS should support old authentication method (with 'uid@REALM.NET' in the 'userPassword' field and passwords in Kerberos).
ok, maybe this will give someone a clue on what do I need to configure. In my OpenLDAP configuration file (slapd.conf) I have the following lines:
sasl-realm COMPANY.INT sasl_realm COMPANY.INT sasl-host ldap.company.int sasl_host ldap.company.int
and in the 'userPassword' field is what I mentioned above. Could anybody help me?
koniczynek napisał(a):
koniczynek napisał(a):
OK, where I can read about that? Doc and wiki seems to have no PAM in them. And is this equal to what I have configured with OpenLDAP? Because when migrating, FDS should support old authentication method (with 'uid@REALM.NET' in the 'userPassword' field and passwords in Kerberos).
ok, maybe this will give someone a clue on what do I need to configure. In my OpenLDAP configuration file (slapd.conf) I have the following lines:
sasl-realm COMPANY.INT sasl_realm COMPANY.INT sasl-host ldap.company.int sasl_host ldap.company.int
and in the 'userPassword' field is what I mentioned above. Could anybody help me?
As somebody earlier mentioned PAM pass through plugin is the best way to accomplish this. And for people, who are looking for documentation for this plugin, it can be found in the README in the plugin source directory (in fedora directory server 1.0.4 for example).
koniczynek wrote:
koniczynek napisał(a):
koniczynek napisał(a):
OK, where I can read about that? Doc and wiki seems to have no PAM in them. And is this equal to what I have configured with OpenLDAP? Because when migrating, FDS should support old authentication method (with 'uid@REALM.NET' in the 'userPassword' field and passwords in Kerberos).
ok, maybe this will give someone a clue on what do I need to configure. In my OpenLDAP configuration file (slapd.conf) I have the following lines:
sasl-realm COMPANY.INT sasl_realm COMPANY.INT sasl-host ldap.company.int sasl_host ldap.company.int
and in the 'userPassword' field is what I mentioned above. Could anybody help me?
As somebody earlier mentioned PAM pass through plugin is the best way to accomplish this. And for people, who are looking for documentation for this plugin, it can be found in the README in the plugin source directory (in fedora directory server 1.0.4 for example).
And now that the server is back up, in cvs.fedora.redhat.com:
README - http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/servers/plugins/pam_pas... config.ldif - http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/servers/plugins/pam_pas...
Richard Megginson napisał(a):
As somebody earlier mentioned PAM pass through plugin is the best way to accomplish this. And for people, who are looking for documentation for this plugin, it can be found in the README in the plugin source directory (in fedora directory server 1.0.4 for example).
And now that the server is back up, in cvs.fedora.redhat.com: README - http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/servers/plugins/pam_pas... config.ldif - http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/servers/plugins/pam_pas...
Yes, now it's possible, but yesterday it wasn't ;)
389-users@lists.fedoraproject.org