Kerberos and LDAP

[Ronni Feldt]

> > Now, I have read a lot, and seems to have lost the complete overview
> > of how it all works together. Can someone explain to me, just in a
> > superficial way, how it fits together or point me to a link?
> 
> There's nothing special really. NSS is used to get user metadata
> (username, id, gid, homedir, shell, etc..), and PAM is used to perform
> the actual verification of user credentials (login allowed or not).
> And nscd is there just to cache NSS results so that the remote lookup
> is not performed all the time.

Okey, this means it's something like this:

1. User login

2. PAM authenticates the user using info in /etc/pam.d/common-auth,
which tells it to use info from the local workstation and kerberos,
because of:
auth    sufficient      pam_unix.so nullok_secure
auth    sufficient      pam_krb5.so use_first_pass
auth    required        pam_deny.so

In this step PAM is also using /etc/pam.d/common-password to find out
how to evaluate passwords. Again both local passwords and passwords in
Kerberos will do.
password  sufficient   pam_unix.so nullok obscure md5
password  required     pam_krb5.so use_first_pass

Question: Am I missing a password required pam_deny.so here?

3. If the user authentication is successful, PAM
uses /etc/pam.d/common-account to grant privileges to the user; the
ressources that the user may have access to. Again local information is
okey, as well as information from LDAP and Kerberos (Why Kerberos? It
only authenticates.)
account sufficient      pam_unix.so
account required        pam_ldap.so
account required        pam_krb5.so


In the steps above, PAM is using NSS (/etc/nsswitch.conf) to get
information about username, privileges etc. NSS bridges the information
from LDAP and/or local information to PAM.
/etc/nsswitch.conf
passwd:         ldap files
group:          ldap files
shadow:         ldap files

hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files
protocols:      db files
services:       db files
ethers:         db files
rpc:            db files
netgroup:       nis


Is that correct ?

- Ronni