I have additional ldap data that I'd like to store in the user's home when they first log into a client using
pam_ldap. However, I can't seem to think of a way to make this work without prompting the user to re-enter their ldap password after logging in.
I thought of using
pam_exec, but I don't know how the client would authenticate to LDAP within
pam_exec without first knowing the user's LDAP password.
Are there any other possible solutions? I understand kerberos is probably better suited for this, but everything I've read about its complexity has made me avoid it like the plague.