Fedora directory users - Nov 2006 - SASL/Kerberos5 question

Hello,
I''m fairly new to the FDS (one week maybe). Earlier I''ve been
using
OpenLDAP and now I want to migrate from OL to FDS. Everything looks
great (schema conversion and ldif transfer) but I have one problem. Old
setup was constructed more or less that the passwords weren''t stored in
LDAP but in Kerberos and in ''userPassword'' field in clear text
was
''uid@REALM.INT''
Now when using FDS I can''t find any configuration option, that would
make it possible to use Kerberos for storing passwords and still to use
FDS to authenticate user. Maybe SASL Mappings are for that and you only
have to configure them right. Is there anyone who knows how to do it?
Thanks in advance.

-- 
email/xmpp: koniczynek@uaznia.net

koniczynek wrote:
> Hello,
> I''m fairly new to the FDS (one week maybe). Earlier I''ve
been using
> OpenLDAP and now I want to migrate from OL to FDS. Everything looks
> great (schema conversion and ldif transfer) but I have one problem. Old
> setup was constructed more or less that the passwords weren''t
stored in
> LDAP but in Kerberos and in ''userPassword'' field in clear
text was
> ''uid@REALM.INT''
> Now when using FDS I can''t find any configuration option, that
would
> make it possible to use Kerberos for storing passwords and still to use
> FDS to authenticate user. Maybe SASL Mappings are for that and you only
> have to configure them right.
Right.  For clients that can do SASL/GSSAPI BIND (i.e. Kerberos), you 
just need to configure the SASL Mapping to find the user''s DN based on 
the Kerberos principal.

For clients that cannot use SASL but must use simple username/password 
bind, you can use the PAM passthrough plug-in.
> Is there anyone who knows how to do it?
> Thanks in advance.
>
>

Richard Megginson, dnia 2006-11-17 21:29 napisal:
> Right.  For clients that can do SASL/GSSAPI BIND (i.e. Kerberos), you
> just need to configure the SASL Mapping to find the user''s DN
based on
> the Kerberos principal.
My company runs a lot of software which can''t use SASL/GSSAPI BIND, so
this is definitely not for me.
> For clients that cannot use SASL but must use simple username/password
> bind, you can use the PAM passthrough plug-in.
OK, where I can read about that? Doc and wiki seems to have no PAM in
them. And is this equal to what I have configured with OpenLDAP? Because
when migrating, FDS should support old authentication method (with
''uid@REALM.NET'' in the ''userPassword'' field
and passwords in Kerberos).

-- 
email/xmpp: koniczynek@uaznia.net

koniczynek napisał(a):
> OK, where I can read about that? Doc and wiki seems to have no PAM in
> them. And is this equal to what I have configured with OpenLDAP? Because
> when migrating, FDS should support old authentication method (with
> ''uid@REALM.NET'' in the ''userPassword''
field and passwords in Kerberos).
ok, maybe this will give someone a clue on what do I need to configure. 
In my OpenLDAP configuration file (slapd.conf) I have the following lines:

sasl-realm COMPANY.INT
sasl_realm COMPANY.INT
sasl-host ldap.company.int
sasl_host ldap.company.int

and in the ''userPassword'' field is what I mentioned above.
Could anybody
help me?

-- 
xmpp/email: koniczynek@uaznia.net
xmpp/email: koniczynek@gmail.com

koniczynek napisał(a):
> koniczynek napisał(a):
>> OK, where I can read about that? Doc and wiki seems to have no PAM in
>> them. And is this equal to what I have configured with OpenLDAP?
Because
>> when migrating, FDS should support old authentication method (with
>> ''uid@REALM.NET'' in the
''userPassword'' field and passwords in Kerberos).
> ok, maybe this will give someone a clue on what do I need to configure. 
> In my OpenLDAP configuration file (slapd.conf) I have the following lines:
> 
> sasl-realm COMPANY.INT
> sasl_realm COMPANY.INT
> sasl-host ldap.company.int
> sasl_host ldap.company.int
> 
> and in the ''userPassword'' field is what I mentioned
above. Could anybody
> help me?
As somebody earlier mentioned PAM pass through plugin is the best way to 
accomplish this. And for people, who are looking for documentation for 
this plugin, it can be found in the README in the plugin source 
directory (in fedora directory server 1.0.4 for example).

-- 
koniczynek

koniczynek wrote:
> koniczynek napisał(a):
>> koniczynek napisał(a):
>>> OK, where I can read about that? Doc and wiki seems to have no PAM
in
>>> them. And is this equal to what I have configured with OpenLDAP? 
>>> Because
>>> when migrating, FDS should support old authentication method (with
>>> ''uid@REALM.NET'' in the
''userPassword'' field and passwords in Kerberos).
>> ok, maybe this will give someone a clue on what do I need to 
>> configure. In my OpenLDAP configuration file (slapd.conf) I have the 
>> following lines:
>>
>> sasl-realm COMPANY.INT
>> sasl_realm COMPANY.INT
>> sasl-host ldap.company.int
>> sasl_host ldap.company.int
>>
>> and in the ''userPassword'' field is what I mentioned
above. Could
>> anybody help me?
> As somebody earlier mentioned PAM pass through plugin is the best way 
> to accomplish this. And for people, who are looking for documentation 
> for this plugin, it can be found in the README in the plugin source 
> directory (in fedora directory server 1.0.4 for example).
And now that the server is back up, in cvs.fedora.redhat.com:

README - 
http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/servers/plugins/pam_passthru/README?root=dirsec&rev=1.5&view=auto
config.ldif - 
http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/servers/plugins/pam_passthru/config.ldif?root=dirsec&rev=1.5&view=auto

Richard Megginson napisał(a):
>> As somebody earlier mentioned PAM pass through plugin is the best way 
>> to accomplish this. And for people, who are looking for documentation 
>> for this plugin, it can be found in the README in the plugin source 
>> directory (in fedora directory server 1.0.4 for example).
> And now that the server is back up, in cvs.fedora.redhat.com:
> README - 
>
http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/servers/plugins/pam_passthru/README?root=dirsec&rev=1.5&view=auto
> config.ldif - 
>
http://cvs.fedora.redhat.com/viewcvs/ldapserver/ldap/servers/plugins/pam_passthru/config.ldif?root=dirsec&rev=1.5&view=auto
Yes, now it''s possible, but yesterday it wasn''t ;)

-- 
koniczynek