[Date Prev][Date Next]
Re: Samba to Kerberos via OpenLDAP
Wes Modes wrote:
First, I'll just say this is a question principally about the arcane
mysteries of Samba to OpenLDAP authentication.
I've had Samba to OpenLDAP authentication running for a while now using
the samba.schema and the ldapsam module. Now I'd like to understand a
bit more about how that works in order to take it a step further and get
openLDAP to bind against a Kerberos database via SASL.
An aside; Yes, I'd heard that Samba can be configured to authenticate
against Kerberos directly, but for my own reasons, I'd prefer that Samba
talk only to OpenLDAP, and OpenLDAP can do the authentication.
Note that you loose the security advantages of Kerberos then. What exactly
are your "own reasons".
I'll fall back on the Samba to Kerberos direct route if I can't find a
way to do what I want.
If the OpenLDAP user database is not your KDC database then I don't think
that it works.
I've noted that the Samba schema and smbldap-tools add to the user
record two Samba specific password fields, sambaNTPassword and
Yupp. That's exactly the point. AFAIK Samba simply compares the hashed
passwords and does not send a bind request on behalf of the end user.
For more details asking the folks on the samba-technical mailing list might
be more helpful.