Hi, Thanks for that description and links. I guess I will play with SSO sometime soon :-).
> I have a system setup using OpenLDAP combined with Cyrus-SASL and Heimdal > kerberos. I have tied samba into it, and will eventually setup samba-tng > as an authentication head for samba. With samba, I may use NTLM > authentication to include more options for SSO. > > The way my setup works is samba has access to use LDAP for accounting and > simple binds (over SSL/TLS). Unfortunately, samba doesn't support kerberos > based authentication "(yet)". In this setup, the users sign on to their > desktop, and the same login is used to access network shares without prompt > for another password (this happens by default on most windows desktops) > using NTLM. > > Various applications using SPEGNO/GSSAPI can provide autologin > functionality using this same login if we chose to implement something to > that effect, but that depends entirely on the applications we might use. > For example, IE and Firefox support SPEGNO/GSSAPI, so enabled web > applications may use this to authenticate the client without additional > credentials. Another example may be squid, as it provides NTLM > authentication mechanisms. > > Even if kerberos or NTLM authentication isn't possible I can still > integrate other services such as pam, Jabber, samba, AND Outlook > addressbook into LDAP using SSL/TLS and simple binds. This makes my setup > more of a flexible centralized authentication system, than simply an SSO > server. In the end, it all comes down to what auth mechanisms the apps > you're using support in your ability to perform SSO. > > I have referenced a lot of these links for my setup. With them, there > should be enough information to create a setup truly exact to your needs: > > Centralized authentication howtos: > http://www.openinput.com/auth-howto/ > http://www.bayour.com/LDAPv3-HOWTO.html > > Samba (TNG) and authentication: > http://www.mami.net/univr/tng-ldap/howto/ > http://www.deschner.de/gd/dual_samba.html > http://www.mami.net/univr/tng-ldap/howto/sambausermapping.html > http://www.samba-tng.org/docs/tng-arch/tng-arch.html > > Other misc resources: > http://acctsync.sourceforge.net/ > http://www.cmf.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html > "Making the big boys play nice..." (one of my favorites) > http://pgina.xpasystems.com/?page_id=3 > > > In a sense, I have been trying to work toward SSO for a while. There are > still many things that require a password on our network though. By > centralizing authentication, I feel that I am one step closer. Anyway, I > hope this helps. > > Regards, > > > Robert Larson -- regards, Georges Toth -- [email protected] mailing list
