I have a well working setup using OpenLDAP for user information and Kerberos for authentication, but we need to have windows integration too, and for this we have decided that moving into Active Directory could be a good idea. Moving account information from OpenLDAP is quite trivial and easily done, but I have a problem: how to move passwords/auth information from MIT Kerberos to AD?
I understand some kind of delegation between them is possible, but this wouldn't solve my problem? Or can I do AD authentication against a MIT Kerberos KDC? Passwords are stored in hashes in Kerberos, so I cannot move them cleartext. I wonder if the hashes would be compatible between MIT and AD, since I can enter the password into AD in crypted form, too.
Does anyone have experience in this? What would be your suggestion aside from just requiring all my users to change passwords and have one major hassle when all authentication switches from one place to the other without any co-existance.