I am currently building a system where I would like to deploy Kerberos. However my external constraints on the user management do not allow me to authenticate the users against Kerberos itself. I do have to authenticate the users against a third party LDAP Server and I can not read the passwords from that.
I do however get the answer whether the authentication was successful or not. I would now like to automatically grant those users a Kerberos ticket for their principal if this authentication is successful. Is there any way that Kerberos can be set up to authenticate via SASL against a third party the password passed to it?
One solution I possibly see is to create keytab files in the users home directories which are automatically used by an init script to aquire Kerberos tickets. However I see a potential for misuse of these keytab files and would prefer a password based alternative.