Kerberos + LDAP + Cyrus-SASL woes

[Digant Kasundra]

A lot of this depends on what LDAP you are planning to use.  Essentially,
there are two ways to use Kerberos with LDAP: one is the SASL method, and
the second is pass-through authentication.

Using SASL, a Kerberos ticket is presented to the LDAP server (if you are
using PAM, you can use pam_krb5 to move authentication into Kerberos instead
of LDAP -- this way, when you login, you authenticate against Kerberos and
have a ticket as a result).  When that ticket is presented to LDAP, the LDAP
server knows how to map that kerberos principal to a dn in the directory.
Ergo, you bind as that dn and get the permissions as specified for that dn
by the access control lists.

The "pass-through" method means that you bind to LDAP using a username and
password.  When you attempt to do so, instead of LDAP authentication that
username/password agaisnt its local store, it contacts the Kerberos KDC and
attempts to verify those credentials (by requesting a ticket).

I think the first method is preferred but since not all applications can
speak Kerberos, the LDAP pass-through is definitely important.  I know that
Sun Java Directory server and OpenLDAP support both methods.

-- Digant C Kasundra

> "James Hunt" <james at oicgroup.net> wrote in message 
> news:1085608258.23946.13.camel at james.office.oic...
> > We are looking to integrate Kerberos with LDAP and PAM 
> (facilitating 
> > communication between Kerberos and LDAP using Cyrus-SASL) 
> on Linux.  
> > On our own, and using documentation found on the web, we 
> have managed 
> > to implement it partially.
> >
> > What we have so far:
> > A working LDAP server that we can bind to and query.
> > A working kerberos KDC that is issuing tickets.
> > A PAM setup that has moved the UNIX authentication 
> (/etc/passwd) into 
> > LDAP.
> >
> > The final product would provide central user authentication (the 
> > Kerberos KDC) and user account management (LDAP), thus 
> providing many 
> > of the services of a Windows Active Directory server.  What we are 
> > stuck on is not so much a configuration or software issue 
> as it is a 
> > conceptual snag.  Where should Kerberos tickets (and 
> possibly keytabs) 
> > be stored to interoperate with LDAP?  How is LDAP supposed 
> to contact 
> > the KDC and receive a ticket?  Is the user supposed to run kinit -f 
> > upon login?
> >
> > Our company, the OIC Group, is looking for someone who really knows 
> > Kerberos and LDAP inside and out, and is willing to lend a hand, 
> > either as a consultant, or a contract system administrator.  OIC is 
> > willing to pay for services rendered.  Our only requirement is that 
> > the working implementation / configuration be well-documented for 
> > future reference.
> >
> > Any help / direction / guidance is greatly appreciated.
> >
> > James Hunt,
> > Senior Programmer
> > OIC Group, Inc.
> > http://www.oicgroup.net/
> >
> > ________________________________________________
> > Kerberos mailing list           Kerberos at mit.edu
> > https://mailman.mit.edu/mailman/listinfo/kerberos
> >
> 
> 
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
>