Principal attributes and policy in LDAP Realm
Azhar K Mustapha
azhar at nervesis.com.my
Fri Jan 2 07:33:03 EST 2009
Dear all.
I have been trying to use Kerberos with kdb ldap backend (openldap 2.4.11).
I have using two ldap servers to emulate multimaster environment for
Kerberos. There are some funny things happened.
1. If I don't enable multimaster replication using ldap, using kadmin.
I can add a Kerberos user, and I can run 'getprinc' command of that user
2. If I enable the multimaster setting with ldap, using kadmin, I can
add a Kerberos user, however, I will get segmentation fault when running
'getprinc' of that user.
Later, I try to use gdb to notice behavior of kadmin. I found out the
segmentation fault happens because in the multimaster setting, the number of
keys generated for the users are 3 instead of 2 in a no multi-masterl
condition, thus, giving a segmentation fault.
Next, I theorize as below,
1. There is a problem with openldap 2.4.11 replication when it comes
to replication binary data of krbPrincipalKey and krbExtraData (data
corruption)
2. Or, there is a problem with kdb ldap itself.
I think this problem is too fundamental for me to fix it myself. Therefore I
am resorting to use the non-ldap storage for Kerberos backend
Azhar
More information about the Kerberos
mailing list