openldap principal

[Gerald (Jerry) Carter]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sat, 3 Jul 2004, Frederic Medery wrote:

> But Why do I need lda/hostname at REALMS principal AND the rootdn in the
> kerberos DB

You don't need a rootdn if I understand you correctly.
technically a rooot dn is optional but if you need one
use the sasl identify format in slapd.conf

    rootdn     uid=<user>,cn=<realm>,cn=gssapi,cn=auth

When I reread you question it sounds like "why do I need a service
principal for the ldap server and a rootdn in slapd.conf?"  Is that
the Q?  The rootdn is slapd.conf and kerberos service principal
are unrelated.




cheers, jerry


> On 2-Jul-04, at 8:56 AM, Gerald (Jerry) Carter wrote:
>
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > On Thu, 1 Jul 2004, Frederic Medery wrote:
> >
> >> My question is : Do I have to create all the users principal or when I
> >> create a ldap user, do i have to create it inside kerberos of the ldap
> >> admin principal with create it for me ?
> >
> > You will need to be able to associate each user principal in the domain
> > with a uidNumber.  The easiest way I can think to explain it is
> > pam_krb5+nss_ldap.  So you will need the posixAccounts in the directory
> > service but not the userPassword (or authPassword) attributes.  The
> > authentication is handled via the KDC and the OS calls to getpwnam(),
> > et. al. go through NSS and out to LDAP.
> >
> > Hope this helps.  Also you might be interested in the Heimdal+LDAP
> > setup described at http://padl.com/esearch/Heimdal.html
> >
> >
> >
> >
> > cheers, jerry
> > -
> > ----------------------------------------------------------------------
> > Hewlett-Packard            ------------------------- http://www.hp.com
> > SAMBA Team                 ---------------------- http://www.samba.org
> > GnuPG Key                  ---- http://www.plainjoe.org/gpg_public.asc
> > "...a hundred billion castaways looking for a home." ----------- Sting
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.2.4 (GNU/Linux)
> > Comment: For info see http://quantumlab.net/pine_privacy_guard/
> >
> > iD8DBQFA5Vt8IR7qMdg1EfYRAoEEAJwIxWJHhpnrQ4lQvd9wrIt+W0+8oACeOMkz
> > vV3B5tYHwhGWf3gl5z/aVqI=
> > =fncH
> > -----END PGP SIGNATURE-----
> >
>
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>

- ----------------------------------------------------------------------
Hewlett-Packard            ------------------------- http://www.hp.com
SAMBA Team                 ---------------------- http://www.samba.org
GnuPG Key                  ---- http://www.plainjoe.org/gpg_public.asc
"...a hundred billion castaways looking for a home." ----------- Sting
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (Darwin)
Comment: For info see http://quantumlab.net/pine_privacy_guard/

iD8DBQFA52SVIR7qMdg1EfYRAnOfAKCihyYXYuXPCvNS/W5otGIuANw1sQCeI4Op
ovrNYKMPJSesQz/qbmfCKh0=
=gZrQ
-----END PGP SIGNATURE-----