I have additional ldap data that I'd like to store in the user's home when they first log into a client using pam_ldap. However, I can't seem to think of a way to make this work without prompting the user to re-enter their ldap password after logging in.

I thought of using pam_exec, but I don't know how the client would authenticate to LDAP within pam_exec without first knowing the user's LDAP password.

Are there any other possible solutions? I understand kerberos is probably better suited for this, but everything I've read about its complexity has made me avoid it like the plague.

  • 1
    Well, expose_authtok would give you the password, wouldn't it? – Ulrich Schwarz Aug 28 '18 at 5:23
  • I completely missed that in the docs! Thanks, I'll give it a try. – Ben Davis Aug 28 '18 at 16:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.