I have an OpenLDAP server that I use for authentication and authorization for various services.
All users are of object type
inetOrgPerson and my groups are
Now I want to configure Samba to authenticate against LDAP as well (with group based authorization). I can't/don't want to use samba as domain controller, but solely as file server. I also don't want to manage user accounts separetely in samba, because I have all information I need in LDAP (user name, password, group memberships). I also want to avoid changing my DIT. As far as I can tell from my current research I cannot do this directly because
a) Samba uses its own credential store for authentication, meaning I'd have to
smbpasswd for every existing LDAP user
b) My LDAP users would have to have samba attributes
After looking around some more I suspect that a solution to my problem could be to use Kerberos in between samba and LDAP.
I have no experience in administrating Kerberos, so before putting effort into that, I want to clarify following topics:
- Are my assumptions correct?
- Can I run Kerberos' Authentication Server and Key Distribution Center on one machine and configure it to only serve granting tickets on localhost? (OpenLDAP and samba run on the same machine)
- Will the usage of Kerberos allow me to keep my DIT unchanged and perform authentication/authorization exclusively with the information that is in LDAP?
- Are there better/easier solutions?
I'm on Ubuntu Server 14.04.
Thanks a lot for any hints in advance