2
votes
0answers
23 views

Kerberos, .k5login and sudo

Background: I am using a Debian 7 system which I have integrated with an LDAP+Kerberos system using libnss-ldap, libpam-krb5 and nscd. I have modified sudoers to permit an LDAP group the right to sudo ...
0
votes
0answers
33 views

bugzilla authenticate with kerberos + ldap + SSO

I want to set up bugzilla with SSO, i cannot find any good documentation on how to do this. I have managed to set up ldap login which works fine. now I have set up kerberos on apache which works fine, ...
0
votes
0answers
56 views

Cannot authenticate as diradmin - OS X Server 10.6 Workgroup Manager

As far as I can tell, not an uncommon problem: when I try to authenticate as 'diradmin' in Workgroup Manager for /LDAPv3/127.0.0.1 it fails with a login problem: "The login information is not valid ...
1
vote
1answer
142 views

What does squid proxy do when negating acl proxy_auth_regex in rule?

The NTLM auth helper only tags users as authorized if they are member of a AD group. The Kerberos auth helper tags a user as authorized, if he was able to log in, the group check can't be done by the ...
0
votes
0answers
324 views

Change local password as root after configuring for MS-AD Kerberos+LDAP

I have followed this excelent post to configure Kerberos + LDAP: http://koo.fi/blog/2013/01/06/ubuntu-12-04-active-directory-authentication/ However, there are some local users used for services. When ...
0
votes
1answer
38 views

DNS Portability with regards to LDAP/Kerberos

How portable is a DNS server when it comes to LDAP, especially Kerberos which I am using for authentication? Meaning, how much do I have to change to use the same LDAP server with 2 different DNS ...
0
votes
1answer
131 views

AD Login to Solaris Zone Periodically Not Working

I have a Solaris 11.1 zone named "AZone". I have the zone joined to an Active Directory domain (Windows Server 2008) with the goal of users being able to use their AD account to log in to the Solaris ...
0
votes
0answers
37 views

Import accounts from Kerberos/OpenLDAP to linux

I have a configuration of our own Kerberos server and OpenLDAP server that manages user accounts. I want to get rid of Kerberos and LDAP altogether and import a list of users as well as their shadow ...
1
vote
2answers
125 views

Managing user and their credentials in kerberos and openldap system

I am learning to use openldap as backend database for kerberos credentials. It is good that all the programs are working with single sign on. The problem is - I can manage user from kadmin command ...
0
votes
1answer
482 views

Autofs + NFS + LDAP sudo problems

I have a setup very similar to Dan Bishop's Ubuntu 12.04 Ultimate Server Guide. I actually created a series of ansible scripts to automate this process on my github. So I have ldap+kerberos set up ...
7
votes
1answer
841 views

IPA vs just LDAP for Linux boxes - looking for a comparison

There are few (~30) Linux (RHEL) boxes and I'm looking for centralized and easy managed solution, mostly for control user accounts. I'm familiar with LDAP, and I deployed a pilot of IPA ver2 from Red ...
0
votes
1answer
153 views

Kerberos + Ldap Setup not working with ssh

I have a Kerberos 5 + LDAP configuration in the same server. They both work well (I assume). Kerberos works fine when asking for a TGT. The problem comes when I try to login from client1 to ...
2
votes
1answer
664 views

Active Directory: Thunderbird LDAP autocompletion not working with Kerberos auth

The Problem: I'm trying to configure an LDAP mail autocompletion - a built-in functionality of Mozilla Thunderbird 17.0.5 @ Windows 7 x64 in 2008R2 domain environment. The OS is a fresh, ...
2
votes
3answers
412 views

Unified Authentication between Windows AD and Linux LDAP Server

Does anyone know of a solution that would allow me to do user account synchronization between Windows Active Directory and an LDAP Server hosted on a Linux Server? I'm currently looking at FreeIPA ...
2
votes
1answer
3k views

Kerberos broken when upgrading Snow Leopard Server to Mountain Lion

I work for a small company where there's no dedicated system admin. I was tasked with upgrading our file and calendar server to 10.8, which I did by upgrading the OS then installing the server tools ...
2
votes
0answers
280 views

issue with heimdal kerberos in ldap backend

I'm having a bit of trouble getting Kerberos (Heimdal version) to work nicely with OpenLDAP. The kerberos database is being stored in LDAP itself. The KDC uses SASL EXTERNAL authentication as root to ...
1
vote
1answer
366 views

Immediate logout after login with PAM, Kerberos, and LDAP

I've set up remote login on a computer using Kerberos and LDAP. I've also configured NFS to mount onto /home so that the user's home directory is the same wherever they login. Kerberos authentication ...
1
vote
1answer
834 views

Apache Kerberos/LDAP: A required input parameter could not be read: An invalid name was supplied (, Unknown error)

(Debian Squeeze) I have Apache authenticating via Kerberos - that works fine. Now I want to restrict the site to a single group only, so I need to add LDAP authorization. I enabled authnz_ldap and ...
1
vote
1answer
400 views

How can I set up an authentication system with single instance storage of credentials and several authentication methods/interfaces?

Background: I have a collection of Linux-based servers (let's say a few dozen) that are hosted in different locations. Some servers are lone satellites while others are hosted together in the same ...
0
votes
4answers
2k views

How to determine the Kerberos realm from an LDAP directory?

I have two Kerberos realms I can authenticate against. One of them I can control, and the other one is external from my point of view. I also have an internal user database in LDAP. Let's say the ...
3
votes
1answer
2k views

Troubles with sssd and Active Directory Integration

I have Debian Squeeze and sssd installed. When I try to login to server by user 'alexwinner' by ssh I see in the log: (Fri May 11 18:56:03 2012) [[sssd[krb5_child[26281]]]] [get_and_save_tgt] (1): ...
0
votes
1answer
1k views

Lookup Active Directory entry by implicit UPN

In our company exists a forest-wide UPN suffix company.com and almost all user accounts have the explicit UPN set to fistname.lastname@company.com. This value is also set in the Active Directory ...
1
vote
1answer
611 views

Can I link proxy users from a single LDS instance to multiple domains?

I have an Active Directory Lightweight Directory Services set up. I have objects that represent users in the Active Directory (Domain_A). I have set their objectSID attribute, and users can ...
0
votes
1answer
796 views

Apache Kerberos Authentication with LDAP Authorization: access to / failed, reason: require directives present and no Authoritative handler

I am trying to get a VirtualHost (well multiple VirutalHosts) up and running with kerberos authentication and group requirements. My latest configuration within the <Directory> directive looks ...
2
votes
2answers
437 views

Active Directory Integration over VPN

I recently started working as a network admin for a company who has 2 locations and we use a VPN to connect them. We need to set up an Active Directory and Exchange Server at the second location to be ...
2
votes
1answer
99 views

Can UNIX/MSAD LDAP/Kerberos authentication work without matching usernames?

It looks as though there is a solid requirement for usernames on the UNIX client and in the MSAD to match for kerberos authentication to function (I think LDAP authentication too). Is this absolutely ...
1
vote
2answers
1k views

Changing user passwords under Kerberos/LDAP

I've set up Kerberos/LDAP on Ubuntu 11.04 Server according to this guide. My client machines are auto-mounting NFS volumes from the server using krb5. All is good: Users can log in to any of the ...
1
vote
2answers
238 views

Kerberos LDAP and Ubuntu Login

I setup Kerberos and LDAP for directory management at an institution for Ubuntu OS. I got LDAP configured correctly and Kerberos. The user's home directory is in an LDAP directory. When the user ...
-2
votes
3answers
247 views

Ubuntu software stack to mimic Active Directory auth

I'm going to have an Ubuntu 11.10 box in a customer's data center running a custom webapp. The customer will not have ssh access to the box, but will need authentication and authorization to access ...
1
vote
1answer
1k views

How do I use ldapsearch with a cross-realm ticket?

kinit user@DOMAIN.TLD klist -afe Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: user@DOMAIN.TLD Valid starting Expires Service principal 08/04/11 13:14:53 08/05/11 ...
4
votes
4answers
2k views

Login using Active Directory in Linux using Kerberos 5

I have a problem with setting up auth for users on Linux (Fedora Core 15 to be exact) using Active Directory on Windows 2008 Server with installed support for UNIX systems. I've successfully setup ...
2
votes
1answer
1k views

FreeBSD: OpenLDAP, SASL, and GSSAPI

I've run into some problems getting OpenLDAP on FreeBSD (8.2-STABLE) to authenticate using Kerberos tickets. I hope I've just had a brain glitch, so please feel free to let me know that I've missed ...
0
votes
2answers
210 views

In LDAP/Kerberos terms world, where do I use which domain parts?

I have a domain name. Let's call it example.com. There's a server - server A - which is has hosting setup on it, and example.com configured as it's domain name. Meaning, resolving example.com, will ...
3
votes
2answers
3k views

How do I configure an ldap server on ubuntu 11.04 ? (for use with subversion and trac)

I have an Ubuntu server 11.04 on ec2 (I'm mentioning this, as it appears things have changed in this version from previous ubuntu releases, when it regards LDAP configuration). I want to configure it ...
1
vote
1answer
317 views

Creating a New Kerberos User

I've inherited a Fedora Linux system running Kerberos, and I'm trying to create a new user. I've been able to bring up the kadmin prompt, and I'm trying to create the user NewUser, so I tried issuing ...
8
votes
4answers
4k views

Linux Central Authentication/Authorization Methods

I have a small but growing network of Linux servers. Ideally I'd like a central place to control User Access, change passwords, etc... I've read a lot about LDAP servers, but I'm still confused about ...
0
votes
1answer
525 views

How to manage ldap users/kerberos principals on Ubuntu server?

I've recently setup a small test network with an Ubuntu server and Ubuntu clients. People can login to a client machine using an account stored in LDAP (created using ldapadduser from the ldapscripts ...
2
votes
3answers
5k views

How to integrate RADIUS with Kerberos?

We've got properly configured LDAP+Kerberos on our wired network. Now we want our users to log in to our WiFi network by using their normal credentials. I've found lots of HOWTOS about LDAP+RADIUS ...
11
votes
2answers
2k views

The Story of secure user-authentication in squid

once upon a time, there was a beautiful warm virtual-jungle in south america, and a squid server lived there. here is an perceptual image of the network: <the Internet> ...
6
votes
1answer
5k views

Seamless SSO with Kerberos, IE, Firefox, LDAP Active Directory

Alias /students /var/www/students <Location /students> KrbServiceName HTTP KrbMethodNegotiate On KrbMethodK5Passwd On KrbSaveCredentials off KrbAuthRealms DOMAIN.LOCAL Krb5KeyTab ...
1
vote
2answers
4k views

Apache SSO with Active Directory and providing authorization based on groups

I'm using rhel5 running a LAMP stack to create an intranet with. I'm attempting to achieve SSO with users on our network using IE and Firefox. Using the following module I'm able to successfully do ...
6
votes
3answers
6k views

Apache mod_auth_kerb and LDAP user groups

I've been considering deploying mod_auth_kerb on our internal web servers to enable SSO. The one obvious problem I can see is that it's an all-or-nothing approach, either all your domain users can ...
1
vote
3answers
1k views

Disabling Windows password changes on Samba domain

When a user on one of our Windows clients hits ctrl-alt-delete to change his password, our Samba domain controller is notified and performs the password change. Unfortunately, the group policy rule ...
2
votes
3answers
721 views

Provide Samba access based on LDAP info?

I'm trying to get a server set up that provides some file shares to Windows clients, and I'd like it to integrate with an existing authentication framework my school already has set up. There's a ...
4
votes
3answers
3k views

Can Windows integrate with LDAP?

Given an existing LDAP server used for authentication, can Windows desktops authenticate users against LDAP or perhaps Kerberos?