Unfortunately, this type of setup is very far from trivial. LDAP and
Kerberos combined can be quite a bit of a pain as it is, and throwing
Samba into the mix only makes things even more painful. That said, the
following link is pretty much the best thing on the web (IMHO) with regard
to doing this:
http://aput.net/~jheiss/krbldap/
The link is a bit out-of-date, and has a few errors that were pretty
painful to diagnose and fix, but I did eventually get a completely
replicated LDAP/Kerberos setup, with a single Samba PDC at the moment
(this is at home, so I'm not *THAT* concerned about the Samba box dying).
I did e-mail the author of the document to note the errors and omissions,
but I never received a reply, nor were my changes added to his site.
That's a real shame, because his documents were (and still are, for the
most part) quite good.
I don't have any of my notes on the subject handy, but the largest issues
that I can remember off hand were:
1. Some the LDAP ACL entries were not correct, or were out-of-date with
current versions of LDAP.
2. I'm pretty sure there was quite a few more steps invovled with getting
Samba to play nicely with a standard LDAP+Kerberos setup. Also, note that
with a standard MIT Kerberos distribution, you will NOT be able to store
Windows passwords in the MIT Kerberos database. The best you can do, as
things stand right now, without any patches to either Samba or Kerberos,
is sync the Kerberos passwords (to be used with everything but Samba) with
the NTLM password hashes stored in the LDAP directory. If you choose to
use Heimdal, I understand that it is possible to use the Samba NT password
hashes for the Kerberos authentication as well, per Andrew Bartlett's
reply to me on the subject from back in April
<http://lists.samba.org/archive/samba/2007-April/130835.html>.
3. Kerberos replication has a few more steps than are detailed on his
page, and really aren't all that clear in any of the official MIT Kerberos
documentation either (i.e. you must create a database on each of your
Kerberos slaves before kpropd will replicate - you won't get any error
messages that indicate that problem either).
I will try and post my notes on the subject later tonight, and I'm sure
I'd hear some corrections to make to them, but in the meantime, the link I
referenced to above is about as good as it gets if you want SSO for
Linux/UNIX and Windows systems, with the backend being served by Linux or
UNIX. At least until Samba 4 comes out, anyway . . . ;-) :-)
--
+-------------------------------------------------+
| Sean Elble |
| Virginia Tech, Class of 2008 |
| Vice President, VTLUUG |
| E-Mail: [EMAIL PROTECTED] |
| Web: http://www.sessys.com/~elbles/ |
| Cell: 860.946.9477 |
+-------------------------------------------------+
On Tue, 3 Jul 2007, Nick Bartos wrote:
Good luck, I've been looking for the same thing for some time now.
Hello,
I am looking for configuration of SAMBA 3.0.25a with LDAP registry and
Authentication with Kerberos.
Any help is appreciated.
Iliya
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
________________________________________________________________________
SES Computer Systems Anti-Virus and Anti-Spam E-Mail Filtering
Powered By ClamAV & SpamAssassin
________________________________________________________________________
SES Computer Systems Anti-Virus and Anti-Spam E-Mail Filtering
Powered By ClamAV & SpamAssassin
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/listinfo/samba
