samba - Mar 2008 - Samba to Kerberos via OpenLDAP

First, I'll just say this is a question principally about the arcane 
mysteries of Samba to OpenLDAP authentication. 

I've had Samba to OpenLDAP authentication running for a while now using 
the samba.schema and the ldapsam module.  Now I'd like to understand a 
bit more about how that works in order to take it a step further and get 
openLDAP to bind against a Kerberos database via SASL.

An aside;  Yes, I'd heard that Samba can be configured to authenticate 
against Kerberos directly, but for my own reasons, I'd prefer that Samba 
talk only to OpenLDAP, and OpenLDAP can do the authentication.  I'll 
fall back on the Samba to Kerberos direct route if I can't find a way to 
do what I want.

I've noted that the Samba schema and smbldap-tools add to the user 
record two Samba specific password fields,  sambaNTPassword and 
sambaLMPassword. 

If I have the ldapsam module specified as the passdb backend in 
smb.conf, is OpenLDAP merely storing the samba passwords while Samba 
does the password comparisons?  Or does OpenLDAP do the authentication 
and return a yes or no?

Is it possible to have Samba defer authentication to OpenLDAP?  If so, I 
can have OpenLDAP use the {SASL} method to do authentication via kerberos.

Wes

-- 

Wes Modes
Server Administrator & Programmer Analyst
McHenry Library
Computing & Network Services
Information and Technology Services
459-5208

First, I'll just say this is a question principally about the arcane 
mysteries of Samba to OpenLDAP authentication. 

I've had Samba to OpenLDAP authentication running for a while now using 
the samba.schema and the ldapsam module.  Now I'd like to understand a 
bit more about how that works in order to take it a step further and get 
openLDAP to bind against a Kerberos database via SASL.

An aside;  Yes, I'd heard that Samba can be configured to authenticate 
against Kerberos directly, but for my own reasons, I'd prefer that Samba 
talk only to OpenLDAP, and OpenLDAP can do the authentication.  I'll 
fall back on the Samba to Kerberos direct route if I can't find a way to 
do what I want.

I've noted that the Samba schema and smbldap-tools add to the user 
record two Samba specific password fields,  sambaNTPassword and 
sambaLMPassword. 

If I have the ldapsam module specified as the passdb backend in 
smb.conf, is OpenLDAP merely storing the samba passwords while Samba 
does the password comparisons?  Or does OpenLDAP do the authentication 
and return a yes or no?

Is it possible to have Samba defer authentication to OpenLDAP?  If so, I 
can have OpenLDAP use the {SASL} method to do authentication via kerberos.

Wes

-- 

Wes Modes
Server Administrator & Programmer Analyst
McHenry Library
Computing & Network Services
Information and Technology Services
459-5208

On Fri, 2008-03-07 at 15:27 -0800, Wes Modes wrote:
> Is it possible to have Samba defer authentication to OpenLDAP?
No.

-- 
Simo Sorce
Samba Team GPL Compliance Officer <simo@samba.org>
Senior Software Engineer at Red Hat Inc. <ssorce@redhat.com>

On Fri, 2008-03-07 at 15:26 -0800, Wes Modes wrote:
> First, I'll just say this is a question principally about the arcane 
> mysteries of Samba to OpenLDAP authentication. 
> 
> I've had Samba to OpenLDAP authentication running for a while now using
> the samba.schema and the ldapsam module.  Now I'd like to understand a 
> bit more about how that works in order to take it a step further and get 
> openLDAP to bind against a Kerberos database via SASL.
> 
> An aside;  Yes, I'd heard that Samba can be configured to authenticate 
> against Kerberos directly, but for my own reasons, I'd prefer that
Samba
> talk only to OpenLDAP, and OpenLDAP can do the authentication.  I'll 
> fall back on the Samba to Kerberos direct route if I can't find a way
to
> do what I want.
> 
> I've noted that the Samba schema and smbldap-tools add to the user 
> record two Samba specific password fields,  sambaNTPassword and 
> sambaLMPassword. 
> 
> If I have the ldapsam module specified as the passdb backend in 
> smb.conf, is OpenLDAP merely storing the samba passwords while Samba 
> does the password comparisons?  Or does OpenLDAP do the authentication 
> and return a yes or no?
> 
> Is it possible to have Samba defer authentication to OpenLDAP?  If so, I 
> can have OpenLDAP use the {SASL} method to do authentication via kerberos.
Not to achieve what you want, due to the reality of NTLM authentication,
Samba cannot defer authentication to anything else, aside from a windows
or Samba domain.  

(The only way to get what you want would be for your KDC to actually
handle the NTLM challenge and response for Samba.  Heimdal has code to
do this, but nobody has written a Samba auth module to do it).

Andrew Bartlett

-- 
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url :
http://lists.samba.org/archive/samba/attachments/20080313/7b5f6fd3/attachment.bin