Re: Trying to get passthrough auth working with OpenLDAP and Kerberos

[Chastity Blackwell <chas@aggregateknowledge.com>]

On Thu, 2012-01-26 at 17:38 -0500, Howard Chu wrote:
> Raffael Sahli wrote:
> > No, authz-regexp is to map a sasl dn to a real user account in your ldap
> > directory.
> >
> > But your user is chas@test.com with a realm named test.com, your
> > userPassword should be {SASL}chas@KRBTEST
> 
> What the heck are you talking about? If the username is chas@test.com then 
> that is what goes in the password:
> 
>    userpassword: {SASL}chas@test.com
> 
> If the realm is actually KRBTEST then the username should be chas@KRBTEST.
> 
> > and also exists as a principal on your kerberos db ;)
> 

Okay, I'm a little confused here now. So here's what I have in
krb5.conf:

[libdefaults]
 default_realm = KRBTEST
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 forwardable = yes

[realms]
 AKTEST = {
  kdc = ldapsandbox.test.com:88
  admin_server = ldapsandbox.test.com:749
  default_domain = test.com
}

[domain_realm]
 .agkn.net = KRBTEST
 agkn.net = KRBTEST

And when I look at my principals in Kerberos, this is what I have:

kadmin:  listprincs
K/M@KRBTEST
chas/admin@KRBTEST
chas@KRBTEST
host/ldapsandbox.test.com@KRBTEST
kadmin/admin@AKTEST
kadmin/changepw@AKTEST
kadmin/history@AKTEST
kadmin/ldapsandbox.test.com@KRBTEST
krbtgt/KRBTEST@KRBTEST
ldap/ldapsandbox.test.com@KRBTEST
root/admin@KRBTEST

So what should the userPassword attribute be set to? I assumed it should
be {SASL}chas@KRBTEST -- is that correct? I just want to make sure I'm
on the right track there.