[Date Prev][Date Next]
RE: Kerberos and LDAP account creation
> -----Original Message-----
> From: owner-openldap-software@OpenLDAP.org
> [mailto:owner-openldap-software@OpenLDAP.org]On Behalf Of Howard Chu
> I don't think it's a good idea to use SASL/GSSAPI
> for that purpose, although TLS and SASL/EXTERNAL should be OK.
I just remembered why this is a bad idea: the KDC must not attempt to use
SASL/GSSAPI to contact slapd, because it would then need a service ticket
for the LDAP service. And of course, it would need to contact slapd to get
the ldap principal's secret key. At this point you get an infinite loop...
> (Think of the sequence of transactions - user does kinit, asks
> KDC for TGT.
> KDC contacts slapd to look up user. If you're trying to use SASL/GSSAPI
> here, that means the KDC has to ask itself for a service ticket to contact
-- Howard Chu
Chief Architect, Symas Corp. Director, Highland Sun
Symas: Premier OpenSource Development and Support