Question on using ldap as password database for heimdal

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

Question on using ldap as password database for heimdal

jay alvarez-2
Hi,
  I'm planning to create a single-sign-on
authentication and authorization in our network.
Kerberos for authentication and ldap for
authorization. My problem is that, only few
application supports the kerberos protocol unlike
the
ldap, and one suggest that I should use kerberos as
much as possible and for applications that can only
authenticate through ldap, use an ldap server which
supports kerberos pass-thru userPasswords. In this
scenario, the duplication of userPassword has been
eliminated but userid still has to reside on both
ldap
database and the kerberos database. I've read that
heimdal supports placing userid/password in an ldap
directory. Will it be safe to do so, or are there
things here I still need to look into? If this is
the
case, does it mean that my whole ldap directory will
be encrypted too because of the way kerberos stores
user credentials?





               
____________________________________________________
Start your day with Yahoo! - make it your home page
http://www.yahoo.com/r/hs
 
Reply | Threaded
Open this post in threaded view
|

Re: Question on using ldap as password database for heimdal

Love Hörnquist Åstrand

jay alvarez <[hidden email]> writes:

> does it mean that my whole ldap directory will
> be encrypted too because of the way kerberos stores
> user credentials?

If you have a master key, the keys will be encrypted (but no other data of
the kerbero data).

You must set you ACL's right in the ldapserver so only the KDC can access
the kerberos bits. You should check your ldap server documentation, and the
setup documentation in the heimdal info-tree (available on web from heimdal
website).

Love



attachment0 (487 bytes) Download Attachment