[Date Prev][Date Next]
Re: Password-less operation
On Wednesday, 8 February 2012 01:22:33 Jean-Luc Wasmer wrote:
> The user db on my system is stored in LDAP and integrated with PAM and NSS.
> The LDAP db also contain address book data for each user. I would like to
> be able to call ldap utilities (e.g. ldapsearch) without having the user
> to enter his/her password everytime. I would also like for scripts running
> as those users to have access to the respective LDAP entries. I noticed
> ldapsearch supports SASL binds, so I was wondering if that could be used
> in conjunction with Kerberos to accomplish my goal
> (from what I
> understand, the kinit command would have to be called before ldapsearch).
You would need to have a TGT. In a Kerberos environment, you should normally
have things in place to ensure this (e.g. pam_krb5 for auth and session would
accomplish getting an initial TGT on a login session).
> Is there any other way to do this?
There are other SASL mechs that may be of use, but also require other
infrastructure or credential distribution. Kerberos/GSSAPI has other
advantages as well, due to wide support/adoption.