Georges Toth wrote:
Hi,
Thanks for that description and links.
I guess I will play with SSO sometime soon :-).
I have a system setup using OpenLDAP combined with Cyrus-SASL and Heimdal
kerberos. I have tied samba into it, and will eventually setup samba-tng
as an authentication head for samba. With samba, I may use NTLM
authentication to include more options for SSO.
The way my setup works is samba has access to use LDAP for accounting and
simple binds (over SSL/TLS). Unfortunately, samba doesn't support kerberos
based authentication "(yet)". In this setup, the users sign on to their
desktop, and the same login is used to access network shares without prompt
for another password (this happens by default on most windows desktops)
using NTLM.
Various applications using SPEGNO/GSSAPI can provide autologin
functionality using this same login if we chose to implement something to
that effect, but that depends entirely on the applications we might use.
For example, IE and Firefox support SPEGNO/GSSAPI, so enabled web
applications may use this to authenticate the client without additional
credentials. Another example may be squid, as it provides NTLM
authentication mechanisms.
Even if kerberos or NTLM authentication isn't possible I can still
integrate other services such as pam, Jabber, samba, AND Outlook
addressbook into LDAP using SSL/TLS and simple binds. This makes my setup
more of a flexible centralized authentication system, than simply an SSO
server. In the end, it all comes down to what auth mechanisms the apps
you're using support in your ability to perform SSO.
I have referenced a lot of these links for my setup. With them, there
should be enough information to create a setup truly exact to your needs:
Centralized authentication howtos:
http://www.openinput.com/auth-howto/
http://www.bayour.com/LDAPv3-HOWTO.html
Samba (TNG) and authentication:
http://www.mami.net/univr/tng-ldap/howto/
http://www.deschner.de/gd/dual_samba.html
http://www.mami.net/univr/tng-ldap/howto/sambausermapping.html
http://www.samba-tng.org/docs/tng-arch/tng-arch.html
Other misc resources:
http://acctsync.sourceforge.net/
http://www.cmf.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html
"Making the big boys play nice..." (one of my favorites)
http://pgina.xpasystems.com/?page_id=3
In a sense, I have been trying to work toward SSO for a while. There are
still many things that require a password on our network though. By
centralizing authentication, I feel that I am one step closer. Anyway, I
hope this helps.
Regards,
Robert Larson
Many thanks for the links a great help. I will be experimenting with a
few setups, if I manage something useful i'll let you know.
Steve.
--
[email protected] mailing list
