0

I have a bit of a complicated situation and I haven't yet been able to solve it with the information I found here and the internet.

I have a user that is allowed to bind to the backend ldap server to an Active Directory domain. I have a few linux machines that should authenticate against this server now and I am unsure how to achieve this. I cannot make any changes to the ldap itself, I am not allowed to bind against the kerberos/AD and I also cannot join the domain with Samba. The password is as most often not readable, not even hashed. So replicating it regularly is not an option. On top of that there is no uid attribute, so in my understanding this rules out pam_ldap.

I would like to delegate the password check to the ldap somehow but keep the uids, gids and so on all someplace else. I would be OK with the rid mapping that winbind does, but I doubt it works without joining the domain.

Is this possible and if yes how? A pointer to a tutorial for the solution would be greatly appreciated.

2
  • Why don't you join the domain? Nov 11, 2016 at 20:23
  • I would if I could, but for political and other reasons it's not possible unfortunately.
    – Max
    Nov 11, 2016 at 22:42

0

You must log in to answer this question.

Browse other questions tagged .