I'm currently trying to set up an integrated Kerberos V/LDAP system for authentication/authorization. From what I have managed to gather, there are at least two ways to integrate Kerberos V with LDAP:
- Use LDAP as a backend to store Kerberos principals
- User Kerberos and SASL authentication via GSSAPI to authenticate to the LDAP server (to be able to query and modify the LDAP entries using a Kerberos ticket)
The two options aren't mutually exclusive. The thing is, I would like to make a hybrid of the two: not just use LDAP to store Kerberos principals, but also make sure that when I add a Kerberos principal, it's created with
objectClass=posixAccount in order for it to appear as a Unix user entry to NSS for authorization purposes.
To paraphrase, I would like to have to add new user accounts in only one place (viz., the
kadmin server) instead of two. Is this possible? If so, how?
If it's any help, I'm using OpenLDAP and MIT Kerberos on Debian Wheezy.