So for the past few weeks I've been configuring an SSO solution for our small company. Right now I have a server running OpenLDAP 2.4.4 with kerberos (openldap backend). Users can login and get a ticket from krb, also using SASL I can connect web applications to LDAP that will authenticate with kerberos (userPassword attribute is {SASL}[email protected]).
Everything was great, until we needed a web application for user self-service (first time account activation, password reset, etc...), after looking for some solutions I found PWM (https://github.com/pwm-project/pwm), after setting up PWM I noticed something, when trying to change a password PWM with try to write to "userPassword" attribute, but that attribute just point OpenLDAP to authenticate with kerberos. After searching some more I couldn't find any web application that supports ldap administration with kerberos authentication, meaning an application that will change the kerberos password and not the "userPassword" attribute in OpenLDAP. So I changed "userPassword" to hold the actual password, and with smbkrb4pwd I can synchronize the passwords in LDAP and kerberos. Great I though, but then I realized that if I change the password in kerberos, the password in LDAP won't change, only if I change it in LDAP then smbkrb4pwd will update it in kerberos. sigh, no problem, I'll just configure PAM to use ldap for "passwd".
And today I started setting up password policies, after finishing the policy in LDAP I found out I need to create a separate one in kerberos, one can't it just use the same one in LDAP? fine. So both password policies were working fine, accounts are being locked out after X failed attempts, great, but then I find out that if I lock my account in OpenLDAP, I can still try and authenticate in kerberos.
So here I am, totally lost on how to continue. Is there any WEB application that knows how to change passwords in kerberos? How can I synchronize account lock in LDAP and kerberos?