Fedora directory users - Dec 2006 - adding an attribute, howto?

I would like to use the pam_passthru plugin to use kerberos  
authentication via pam_krb5, but am running into a few issues.  I  
need to specify an attribute to use, as I have multiple realms--my  
uid is just a login name, for the kerberos to work I need  
<uid>@<realm>.  I wasn''t sure what to use for the
attribute, and was
thinking of hijacking the ''description'' attribute for this
purpose.
However another posting to this list gave me the idea of just  
extending the schema with an additional attribute in 99user.ldif.  I  
would likely want to copy the definition for ''uid'' from, say
class
posixaccount, but rename it to krb5uid or something.  Can anyone  
point me to detailed instructions?  Is this trivial or difficult?  I  
looked at the current schema files and was not sure what I wold need  
to copy to make it work, and how to add the new attribute explicitly  
to the class schema as an optional attribute.

What are the consequences of adding such an attribute when  
replication is occurring?  I assume I must extend the schema on each  
server, what happens if I neglect to extend the schema on one server  
and it receives replica info that has this new attribute populated  
for some users?

I would also entertain the idea of having an attribute with just the  
realm (or a proxy for the realm), and constructing the krbuid  
equivalent via some operational attribute that constructs it via uid  
+ "@" + realm on the fly, if this is possible.  I might even be able  
to do this using existing location attribute or another existing  
attribute, I can easily  determine the correct realm from  
corresponding location-specific info associated with each user.  But,  
I don''t know how to do this in practice.

Also, if anyone has an example pam ldapserver file they could share,  
I would appreciate it.

-Marty

MJD Shop Account wrote:
> I would like to use the pam_passthru plugin to use kerberos 
> authentication via pam_krb5, but am running into a few issues.  I need 
> to specify an attribute to use, as I have multiple realms--my uid is 
> just a login name, for the kerberos to work I need
<uid>@<realm>.  I
> wasn''t sure what to use for the attribute, and was thinking of 
> hijacking the ''description'' attribute for this purpose. 
However
> another posting to this list gave me the idea of just extending the 
> schema with an additional attribute in 99user.ldif.  I would likely 
> want to copy the definition for ''uid'' from, say class
posixaccount,
> but rename it to krb5uid or something.  Can anyone point me to 
> detailed instructions?  Is this trivial or difficult?  I looked at the 
> current schema files and was not sure what I wold need to copy to make 
> it work, and how to add the new attribute explicitly to the class 
> schema as an optional attribute.
It''s not that difficult to create your own attribute.  The hardest
thing
is creating your own OID.  If you just try to copy the definition of uid 
without creating a unique OID, you will get lots of errors.

Once you do that, you can just add your new attribute using ldapmodify.  
Not only will this add your new attribute type to 99user.ldif, but it 
will also ensure that it will be replicated.

You should then create your own AUXILIARY objectclass that has your new 
attribute type as an allowed attribute, and add this objectclass to all 
users that you want to add the attribute to.  Also add your objectclass 
definition using ldapmodify to ensure it is replicated
properly.
>
> What are the consequences of adding such an attribute when replication 
> is occurring?  I assume I must extend the schema on each server, what 
> happens if I neglect to extend the schema on one server and it 
> receives replica info that has this new attribute populated for some 
> users?
Schema replication happens before data replication.
>
> I would also entertain the idea of having an attribute with just the 
> realm (or a proxy for the realm), and constructing the krbuid 
> equivalent via some operational attribute that constructs it via uid + 
> "@" + realm on the fly, if this is possible.  I might even be
able to
> do this using existing location attribute or another existing 
> attribute, I can easily  determine the correct realm from 
> corresponding location-specific info associated with each user.  But, 
> I don''t know how to do this in practice.
This is not really possible.  I suppose the right way to do this would 
be to extend the SASL mapping code to be used by pam
passthrough.
>
> Also, if anyone has an example pam ldapserver file they could share, I 
> would appreciate it.
>
> -Marty
>
>
> ------------------------------------------------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>