Current ideas on kerberos requirements for Samba4

James F. Hranicky jfh at
Tue May 24 11:38:58 EDT 2005

On Tue, 24 May 2005 19:56:33 +1000
Andrew Bartlett <abartlet at> wrote:

> This is the situation we are in currently, the Microsoft clients expect
> a very tight interface between the KDC and the rest of the domain
> controller (requiring coherent operations over multiple protocols, the
> PAC and other fun things).  

I'm no expert on anything, but that's not going to stop me :->

Personally, I'm quite wary of seeing new KDC/LDAP implementations. We 
already have good ones out there under active development, and I'd like 
to see them used in the project instead of yet more code duplication.

I don't know the intimate details of what AD clients expect from an AD 
controller, but I wonder if perhaps the requirements could be addressed 
by a meta-smbd of sorts? The meta-smbd acts as an AD controller, but 
passes off requests for various services to the respective daemons, 
something like this:

  XP -- TGT/PAC req -->             -- AS_REQ --> Heimdal/MIT KDC 
                                    <-- TGT --
     <-- TGT/PAC                    -- Group LDAP req --> OpenLDAP
                        (genPAC)    <-- groups 

That's just one example. I don't know how feasible it is, but I 
just thought I'd throw the idea out.

Since one of the motivating factors for the integration of services is
the difficulty experienced when trying to integrate the various packages
to work together, perhaps this should be the area of focus for an AD
controller clone: scripts/configuration systems that make it easy to 
combine all the various packages out there (Heimdal/SASL/OpenLDAP/etc)
to work together in a conherent way to form the basis for a production-level
AD controller. I know how hard it can be having done it myself, but I don't
know if that's a good reason to try to re-implement functions that are
already available in stable, actively-maintained packages. Focusing on 
easing the integration seems a better route IMO.

| Jim Hranicky, Senior SysAdmin                   UF/CISE Department |
| E314D CSE Building                            Phone (352) 392-1499 |
| jfh at             |

More information about the krbdev mailing list