I have multiple Linux servers all configured to allow kerberos authentication with active directory. All other user and group attributes reside in a separate directory server (389). I am able to log in and fetch user information (getent passwd, id, getent group, etc...)
Now, each of these servers hosts a kerberized application (one per server) which users may access. Some of these applications do not use PAM. Is there a way by which I can restrict certain users to only access some of the applications/servers depending on whether they are members of a particular group?
My idea was to somehow find a way to restrict AD so that service tickets are only issued if the user is a member of a particular AD group. Alternatively there could be some configuration from the Linux side (example within krb5.conf) that allows me to perform authorisation checks or some how trigger the PAM session and account checks.
Thanks