Supposedly, in order to set up Kerberos, I need to run
kdb5_ldap_util, though I'm not sure why. However, it fails with:
# kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees dc=example,dc=com -r EXAMPLE.COM -s -H ldapi:/// Password for "cn=admin,dc=example,dc=com": Initializing database for realm 'EXAMPLE.COM' You will be prompted for the database Master Password. It is important that you NOT FORGET this password. Enter KDC database master key: Re-enter KDC database master key to verify: kdb5_ldap_util: Invalid syntax while creating realm 'EXAMPLE.COM'
I have no idea what that error means. Googling about has lead me to believe that it's a cryptic way of telling that the "kerberos schema" hasn't been "loaded" into the LDAP server yet. Checking
/etc/ldap/schema, there isn't a
kerberos.schema or anything equally obvious. There is, as some resources point out, a
/usr/share/doc/krb5-kdc-ldap/kerberos.ldif.gz. (Why are these gzipped, other than to be obtuse to use?)
gunziping those two files into
/etc/ldap/schema and running the following:
# ldapadd -Y EXTERNAL -H ldapi:/// -f kerberos.ldif SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 ldapadd: invalid format (line 5) entry: "cn=schema"
Line 5 is a comment.
This is the same command that I had to run on all the other LDIF files in that directory in order to get OpenLDAP working in the first place. Why doesn't this schema work?
The error tells me nothing about what's going wrong, but this seems to be a close match (but implies that the Kerberos schema is broken out of the box): do I need to edit it as suggested there? Some other resources seem to also suggest the LDIF needs a
cn: entry for each part: is that needed as well/