[Date Prev][Date Next]
Best objectClass for an LDAP server?
- To: email@example.com
- Subject: Best objectClass for an LDAP server?
- From: Jaap Winius <firstname.lastname@example.org>
- Date: Tue, 19 Jan 2010 18:32:28 +0100
- Content-disposition: inline
- User-agent: Internet Messaging Program (IMP) H3 (4.1.5)
Busy again with the configuration of my OpenLDAP 2.4.11 test system,
which includes Kerberos, SASL and GSSAPI, I now not only have
replication working with Kerberos authentication and encryption), but
also SASL proxy authorization, which makes chaining possible (chasing
referrals on behalf of clients).
For proxy authorization to work, I first had to create an LDAP object
to represent the DN that the consumer server was authenticating with
-- after the name of its Kerberos principal. Here it is in
Not wanting to use the person objectClass for this purpose, I used
description: LDAP server2 replicator
Does this look like the best solution? It does force me to include a
userPassword attribute, for which I use an invalid hash, but otherwise
there are no other unnecessary attributes. Still, I wonder if I could