Getting user info via LDAP, authenticating via Kerberos

[John Koelndorfer]

Hello again,

Firstly, thanks to those who have taken time to shoot an e-mail my way 
to try and help. It's greatly appreciated.  Secondly, sorry to be 
sending out another list mail but I notice that the suggestions I got 
were all more or less the same -- look at PAM. I think I may not have 
been clear enough in my last e-mail, so I'll try to explain again. I 
also forgot to include version numbers and attach some config files. 
Again, my apologies.

Also, I don't do much in the realm of mailing lists so I'm unsure if it 
is expected that most people that write in are subscribed. I happen not 
to be, so please reply directly to my address if you would.

Our servers are primarily running RHEL4:
`cat /etc/issue`
Red Hat Enterprise Linux AS release 4 (Nahant Update 7)
Kernel \r on an \m

Some important lib versions (I don't think I missed any but I am far 
from an expert):
`rpm -qa | grep krb5`
krb5-workstation-1.3.4-60.el4
krb5-auth-dialog-0.2-1
krb5-libs-1.3.4-60.el4
pam_krb5-2.1.17-6.el4

`rpm -q "nss_ldap"`
nss_ldap-253-5.el4

Finally, a kernel version:
`uname -r`
2.6.9-78.ELsmp

The suggestions I got via e-mail were to look at my PAM configuration. 
What I was attempting to convey before was that I have indeed gone over 
PAM settings and here's what I have:

I can successfully get a Kerberos ticket (it is shown in `klist` after 
login) **if ldap is not listed in nsswitch.conf**. Here's a snippet to 
show what I mean:

passwd:     files
shadow:     files
group:      files

The above works. However, I have to create a local user account for the 
user I want to log in with. This is not something I'd like to have to 
do. Now, here's a non-working snippet:

passwd:     files ldap
shadow:     files ldap
group:      files ldap

The above causes `klist` to not show Kerberos tickets (and in fact they 
aren't retrieved as users cannot access homes). Nothing in the PAM 
configuration changed in this test.

I've provided somewhat censored versions of /etc/krb5.conf, 
/etc/ldap.conf, /etc/pam.d/system-auth, and /etc/nsswitch.conf. I hope 
these will be helpful if anyone would be kind enough to help. If 
something else is needed, please do let me know.

John Koelndorfer wrote:
> Hello everyone,
>
> I've got a tricky problem that's been gnawing at me for the past few 
> days or so. First, a little background:
>
> We're running an active directory setup with the usual Windows domain 
> controllers (they're Windows 2000, if it matters) but users' home 
> directories are stored on a Linux box running Samba. Our other Linux 
> servers will need to get at these homes for various reasons. Our setup 
> is fine with NFSv3, but we were looking to gain security and move up 
> to NFSv4 with Kerberos authentication. NFSv4 won't allow people to 
> access their home directories without a valid Kerberos ticket for 
> their principal. If this could be turned off somehow, that'd be one 
> way to fix this issue (all_squashing to root doesn't sound 
> particularly appealing) otherwise I need users to be able to get their 
> Kerberos ticket on login.
>
> That works fine as long as ldap is not listed in nsswitch.conf. The 
> problem is we need to use ldap to fetch user info.
>
> So, here's a quick example in case I wasn't clear enough:
> I ssh to our server using my domain credentials, kdorf and password.
>
> If I have a local user account on that machine and ldap is *not* 
> listed in nsswitch.conf, I can login using my domain password and a 
> valid Kerberos ticket is fetched for me -- I get access to my home.
>
> If I don't have a local account on that machine and ldap *is* listed 
> in nsswitch.conf, I can login using my domain password but `klist` 
> shows that I do *not* have a valid Kerberos ticket. Home directory 
> access is denied.
>
> I need to have valid Kerberos tickets fetched for ldap users. 
> Alternatively, I would like NFSv4 to not sweat people about Kerberos 
> tickets to access their homes. Is this possible?
>
> Thanks in advance for your help.
> John

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: krb5.conf
Url: http://mailman.mit.edu/pipermail/kerberos/attachments/20090327/465475f7/attachment.bat
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: ldap.conf
Url: http://mailman.mit.edu/pipermail/kerberos/attachments/20090327/465475f7/attachment-0001.bat
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: nsswitch.conf
Url: http://mailman.mit.edu/pipermail/kerberos/attachments/20090327/465475f7/attachment-0002.bat
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: system-auth
Url: http://mailman.mit.edu/pipermail/kerberos/attachments/20090327/465475f7/attachment-0003.bat