Tag Info

Hot answers tagged

16

With the versions of Samba found in current versions of common distributions you can certainly have a Linux machine act as an NT-style domain controller (this has been the case for some time). I believe that taking part in an AD based domain is being actively worked on but not yet ready for production use, though it isn't something I've looked at recently ...


11

LDAP cannot provide Single Sign On. There is a big difference between being able to use the same users and having Single Sign On, which means that you login into all systems at once, with a single login form. Otherwise, LDAP is perfectly feasible for using the same login information in all systems. OAuth is just a protocol for doing the Sign On and it can ...


8

There are a couple things you can do with Google Apps. You can setup a SAML server connected to your AD network and then setup Google to authentication your Google Apps access against the SAML server. We have used a php application called simpleSAMLphp because we already have servers setup to run PHP and we have developers with php skills. The drawback of ...


8

Its not hard and it's perfectly practical. We have a few hundred dual boot desktop machines that use AD auth as well as a number of servers which use AD auth to enable windows clients to use their samba shares without explicit auth by the users. There was another article on SF about what you need to do. Basically you need to config kerberos, winbind, nss ...


8

Google has led you down the right track. Ideally you want both LDAP for the central user management and Kerberos for it's added security and SSO. LDAP alone will get you centralized user management but users will still have to re-authenticate with each service they are connecting too. That's where Kerberos comes in which issues the client a ticket which ...


7

It is now possible in mod_auth_kerb 5.4 to strip the realm from REMOTE_USER with the following config directive: KrbLocalUserMapping On Of course, no Debian/Ubuntu version seems to ship 5.4 yet (sigh).


7

First of all - and in case other users happen to visit this page - there are only certain authentication methods that allow you to do promptless SSO. These are NTLM and Kerberos. LDAP - on the other hand - will never give you promptless SSO. NTLM is actually NTLMv1 and NTLMv2. These are very different and NTLMv1 is deprecated because of serious security ...


7

Yes, it is quite possible to push out certificate trusts to users. This is done through Group Policy. You can find it under Users -> Windows Settings - > Security Settings -> Public Key Policies. From there you can manage which certificates and certificate-authorities are to be trusted. The same hive exists on the Computer side of the GPO as well. You'll ...


6

Authenticating is absolutely simple using Likewise Open. http://www.likewise.com/products/likewise_open/index.php Nearly my entire Linux infrastructure has centralized authentication and user management thanks to Likewise Open. It's stunningly simple to install and implement. I cannot possibly say enough good about it. As a note, UIDs and GIDs are ...


5

Perhaps "Centralized Authentication".


5

My gut says you've got a very large security token, possibly because the user is a member of a large number of groups. The AD Kerberos implementation is going to provide Apache with a Privilege Attribute Certificate (PAC) by default. This structure can be large if the user is a member of a significant number of groups. You can use the tokensz.exe tool to see ...


5

Short answer: No. However, like @Nathan-C described, you can stand up the required services using Azure Iaas (either DC+DirSync+ADFS or DC+Dircync w/pwd sync) in order to achieve single sign-on between your your Office365 apps and your on-prem apps. You would need to deploy a VPN link between Azure and your local network. Azure AD is NOT "regular" Active ...


4

Samba4 is going to be able to do that, but it's still in alpha. If you're adventurous you can play with the latest releases.


4

It's the whole point of the authn/authz separation in 2.2 that you can authenticate with one mechanism, and authorize with another. Authentication provides you with a setting of REMOTE_USER, which you then can use authz_ldap against. In addition, authn_ldap searches then for a user (converting the REMOTE_USER to a DN if found, using search criteria you have ...


4

Regarding the first question: I've worked with another LDAP system that allowed 'login' against various user attributes. The solution was to do two connections. The first connection, probably anonymously bound, queries LDAP with the user-supplied information to locate the RDN of their user object. The second connection attempts a bind-with-password with the ...


4

I've found the Spinlock guides excellent for this; I've used them to set up an SSO environment with ssh ticket forwarding for a development office of about 30 developers. There are a lot of different components to this and it's somewhat of a bear to manage - you'll want a good LDAP client like Apache's Directory Studio for user maintenance. If there's an ...


4

When I left my last job, they had to go through much the same process. I had managed to get access to pretty much every root-like password we had. There was a mini-project to map out everything I had access to, and I gave them lists of where I knew I had access. My whole last week I had steadily reducing rights as various passwords, ACLs, and ...


4

We decided that the combination of adding "ClearPass" to CAS and modifying the Exchange setup was going to be too hard to maintain, so our final solution is something like the squirrelmail solution that we didn't like. That is, we send HTML like this to the user ($something generally means an already properly escaped variable) from a button they push in our ...


4

The Official OpenAM Website has a Downloads section. Quoting the page you linked to: If you have not already done so, download and unzip the openam_953.zip file The Client SDK and samples are then available in the zip-root/openam/samples/openam-client.zip (corrected for current version of software, 9.5.3 as opposed to 9.0)


4

I have attempted the exact same thing as you have, specifically attempting to manage Linux and Windows with the same toolset, and have found nothing but pain and frustration. The two are so very different in setup, outlook, and design assumptions that tools that work well on one (SSH, PowerShell) are ugly, fragile hacks on the other platform (yes, there ...


4

Your pam configuration for passwd usually /etc/pam.d/chpasswd is making a call to pam_krb5.so either directly or as part of an include statement. Kerberos (GSSAPI/SPNEGO) for HTTP SSO is handled outside of pam making the most expedient solution to remove it entirely from your pam config (hopefully using a similar method as to what put it in).


3

My answer is going to be "why would you want to?" You're probably far better off implementing a Windows DC; it won't cost you that much, and you'll be on a supported and more predictable environment. AD isn't difficult - there's a lot in it, but it's not difficult. So long as you don't do bizarre or wacky stuff with it, it's incredibly robust and has low ...


3

Kerberos gets you 90% there. Then you've got to get your browsers passing kerberos tokens to internal websites (look in about:config on Mozilla variants, search for "nego" to see the preferences). After that, RADIUS-type authentication for the things that require passwords, or LDAP.


3

Not in regards to your specific question, but as SCO has gone into Chapter 7 bankruptcy (liquidation) you should be moving off it urgently. Samba-TNG no longer exists, that got merged back in to become Samba 3, and is long obsolete. Unless you need AD for group policy the Samaba implementation of NT4 domains should be enough (I know companies of >50 people ...


3

I installed Windows Services for Unix and added a user in AD called "Unix Authenticator", then made the following config file changes on the linux machines: /etc/ldap.conf host ldap.<foo>.com base cn=Users,dc=<foo>,dc=com binddn cn=Unix Authenticator,cn=Users,dc=<foo>,dc=com bindpw <password> nss_base_passwd ...


3

If you're just looking for authentication I'd get ldap auth setup on the Linux and AS400 machines. Using SFU's NIS does work, albeit a beast to get working in the first place. Linux.com has a good starter article. The Four Hundred Guru has an article on AD integration, though it's not quite as step-by-step as the previous. Honestly, I'm not that familiar ...


3

Looks like Apache httpd should be able to do all those things using: http://httpd.apache.org/docs/2.2/mod/mod_proxy.html http://httpd.apache.org/docs/2.2/mod/mod_proxy_balancer.html http://httpd.apache.org/docs/2.2/mod/mod_rewrite.html http://modauthkerb.sourceforge.net/ ... This is of course not an out-of-the-box solution, but with some googling it ...


3

No, this is not going to work, at least not in any reliable form, and it's quite likely these files are needed before NFS shares could be mounted, which would make it impossible. If you have such problems with LDAP, you might have a look into NIS, which is an kind of an (ancient) predecessor of LDAP and is arguably easier to get running. But as I said, ...


3

When ADFS 2.0 is used as a service provider (i.e. RP STS) it consumes assertions at URLs like https://sts.contoso.com/adfs/ls/ . The assertion consumer service URL is specific to the service provider. If ADFS is the service provider then the metadata URLs publish the assertion consumer URLs as follows. <AssertionConsumerService ...


3

Got this straightened out.. On the Session Hosts.. In Remote Desktop Configuration... RDP-TCP Properties... Log on Settings Tab... I did not have selected "Use client-provided log on information" Once I selected that, on each of the session hosts in the farm. no more double login Hope this helps someone else out



Only top voted, non community-wiki answers of a minimum length are eligible