RE: Kerberos and LDAP account creation

["Howard Chu" <hyc@highlandsun.com>]

> -----Original Message-----
> From: owner-openldap-software@OpenLDAP.org
> [mailto:owner-openldap-software@OpenLDAP.org]On Behalf Of Howard Chu

> I don't think it's a good idea to use SASL/GSSAPI
> for that purpose, although TLS and SASL/EXTERNAL should be OK.

I just remembered why this is a bad idea: the KDC must not attempt to use
SASL/GSSAPI to contact slapd, because it would then need a service ticket
for the LDAP service. And of course, it would need to contact slapd to get
the ldap principal's secret key. At this point you get an infinite loop...

> (Think of the sequence of transactions - user does kinit, asks
> KDC for TGT.
> KDC contacts slapd to look up user. If you're trying to use SASL/GSSAPI
> here, that means the KDC has to ask itself for a service ticket to contact
> slapd...

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support