0

So for the past few weeks I've been configuring an SSO solution for our small company. Right now I have a server running OpenLDAP 2.4.4 with kerberos (openldap backend). Users can login and get a ticket from krb, also using SASL I can connect web applications to LDAP that will authenticate with kerberos (userPassword attribute is {SASL}[email protected]).

Everything was great, until we needed a web application for user self-service (first time account activation, password reset, etc...), after looking for some solutions I found PWM (https://github.com/pwm-project/pwm), after setting up PWM I noticed something, when trying to change a password PWM with try to write to "userPassword" attribute, but that attribute just point OpenLDAP to authenticate with kerberos. After searching some more I couldn't find any web application that supports ldap administration with kerberos authentication, meaning an application that will change the kerberos password and not the "userPassword" attribute in OpenLDAP. So I changed "userPassword" to hold the actual password, and with smbkrb4pwd I can synchronize the passwords in LDAP and kerberos. Great I though, but then I realized that if I change the password in kerberos, the password in LDAP won't change, only if I change it in LDAP then smbkrb4pwd will update it in kerberos. sigh, no problem, I'll just configure PAM to use ldap for "passwd".

And today I started setting up password policies, after finishing the policy in LDAP I found out I need to create a separate one in kerberos, one can't it just use the same one in LDAP? fine. So both password policies were working fine, accounts are being locked out after X failed attempts, great, but then I find out that if I lock my account in OpenLDAP, I can still try and authenticate in kerberos.

So here I am, totally lost on how to continue. Is there any WEB application that knows how to change passwords in kerberos? How can I synchronize account lock in LDAP and kerberos?

1 Answer 1

0

I couldn't find any web application that supports ldap administration with kerberos authentication, meaning an application that will change the kerberos password and not the "userPassword" attribute in OpenLDAP.

  • See this question, about the overlay module to keep samba LDAP and Kerberos passwords in sync. Eg in Debian the package is called:

    "slapd-smbk5pwd - Keeps Samba and Kerberos passwords in sync within slapd."

Is there any WEB application that knows how to change passwords in kerberos? How can I synchronize account lock in LDAP and kerberos?

  • Now, there is an App in Univention corporate Server UCS that enables users to change its password via a Web module. A Linux distro that make those authentication intricacies work right out of the box.

DISCLAIMER: I work for Univention =).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .