I'm currently trying to set up an integrated Kerberos V/LDAP system for authentication/authorization. From what I have managed to gather, there are at least two ways to integrate Kerberos V with LDAP:

  1. Use LDAP as a backend to store Kerberos principals
  2. User Kerberos and SASL authentication via GSSAPI to authenticate to the LDAP server (to be able to query and modify the LDAP entries using a Kerberos ticket)

The two options aren't mutually exclusive. The thing is, I would like to make a hybrid of the two: not just use LDAP to store Kerberos principals, but also make sure that when I add a Kerberos principal, it's created with objectClass=posixAccount in order for it to appear as a Unix user entry to NSS for authorization purposes.

To paraphrase, I would like to have to add new user accounts in only one place (viz., the kadmin server) instead of two. Is this possible? If so, how?

If it's any help, I'm using OpenLDAP and MIT Kerberos on Debian Wheezy.

1 Answer 1


Since nobody answered this question and I found no existing solutions to this, I rolled my own solution in Perl. The solution is geared towards Debian specifically because this is my target environment. Feel free to fork it and adapt it to your needs.

Your comments on the code/coding style would be very appreciated. Feel free to tear it to shreds: I'm not a developer by training and I'm relatively new to scripting administrative tools.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .