AD Group Policy Management and Kerberos / LDAP Post: 302955787

Sponsored Content

Top Forums UNIX for Advanced & Expert Users AD Group Policy Management and Kerberos / LDAP Post 302955787 by bakunin on Monday 21st of September 2015 02:26:08 PM

09-21-2015

Registered User

As you have already noticed what M$$ calls "AD" is in fact a LDAP domain with a Kerberos 5 authentication frontend.

This sounds like every system able to participate in an LDAP domain and with an available Kerberos client should be able to participate, but alas this is not true.

LDAP knows "entities", which are defined by the properties they possess (like a table definition in a database with the fields as properties). LDAP itself does not prescribe this structure (this in fact is part of the configuration of an LDAP domain and one of the reasons why this is best left to experts in the field - you can easily end up with a structure that is nearly impossible to handle in practice) but implementations such as M$$ AD does exactly that. So, in fact it is a prefabricated LDAP domain with every ounce of expandability and configuratbility carefully wrung out so that it will not work with anything else than the graphical computer virus sold in Redmond.

Especially the properties of "login shell" and "home directory", which are not necessary in Windows but in any UNIX(-like) OS are left out and you are no allowed to put them in - or lose any support there might be. Microsoft claims that you are using their (cough) product out of spec in this case. The company i work ATM for is actually in exacly this position.

Our solution (which is far from being commendable) is to manage user accounts manually on the AIX systems and just do the authentication part via Kerberos.

To use Kerberos 5 on an AIX client install the "krb5.client.*" and the "krb5.lic" packages available for AIX. Kerberos configuration is done either by hand (/etc/krb5/krb5.conf) or using the command mkkrb5clnt.

Then define users using the "Krb5Files" as "registry" and "system"-properties:

Code:

chuser registry=Krb5Files system=Krb5Files <username>

Similar for "mkuser", etc..

I hope this helps.

bakunin

/PS: if found this IBM link but have no experience with this. You will simply have to try it. I would love to hear from your experience, though.

This User Gave Thanks to bakunin For This Post:

bakunin

View Public Profile for bakunin

Find all posts by bakunin

7 More Discussions You Might Find Interesting

1. HP-UX

LDAP/Kerberos Issue

I am getting the following error message when trying to login to the client: while verifying tgt If I move the /etc/krb5.keytab out of /etc, it works fine. This is HP-UX v23 Does anyone have any ideas?

2. AIX

Kerberos and LDAP Auth

Good day I am trying to configure Kerberos and LDAP authentication on AIX 5.3 with Windows 2003 R2 but something is not quite right. When I ran kinit username I get a ticket and I can display it using klist. When the user login I can see the ticket request on Windows 2003, but the user...

3. UNIX for Advanced & Expert Users

Compiling Samba from Source on AIX, Active Directory, LDAP, Kerberos

Hello, I asked this question in the AIX subforum but never received an answer, probably because the AIX forum is not that heavily trafficked. Anyway, here it is.. I have never had any issues like this when compiling applications from source. When I try to compile samba-3.5.0pre2, configure runs...

4. Solaris

how to assign group policy to user in solaris

hi, how to assign group policy to user in solaris

5. Windows & DOS: Issues & Discussions

QOS packet scheduler and group policy

hi, did anyone know how to configure a priority of dns ports (and other ports) on QOS on windows 2003? hard to understand the group policy "explain" tab on 'qos packet scheduler', no elaboration on how to use it. thanks for any comment you may add. ---------- Post updated at 05:03 PM...

6. Solaris

LDAP Problem during Kerberos setting for Win server 03 Active Directory

Hi, FYI, I'm new in Solaris I'm trying to use Kerberos on authenticating LDAP Client with the Active Directory on Windows Server 2003 on both Solaris 10 5/08 and Solaris 10 9/10 by referring to the pdf file kerberos_s10.pdf available at sun official site. ...

7. AIX

Trouble with Kerberos/LDAP and AIX 6.1

The KRB5ALDAP compound load module is giving me fits. Everything looks like it should be working, but no. Goal: Integrate AIX host with Active Directory using a KRB5ALDAP compound load module so that users can be created in AD and used in AIX, with unix attributes (registry values) being...

LEARN ABOUT DEBIAN

krb524_convert_creds_kdc_ccache

KRB524_CONVERT_CREDS_KDC(3)				   BSD Library Functions Manual 			       KRB524_CONVERT_CREDS_KDC(3)

NAME

     krb524_convert_creds_kdc, krb524_convert_creds_kdc_ccache -- converts Kerberos 5 credentials to Kerberos 4 credentials

LIBRARY

     Kerberos 5 Library (libkrb5, -lkrb5)

SYNOPSIS

     #include <krb5.h>

     krb5_error_code
     krb524_convert_creds_kdc(krb5_context context, krb5_creds *in_cred, struct credentials *v4creds);

     krb5_error_code
     krb524_convert_creds_kdc_ccache(krb5_context context, krb5_ccache ccache, krb5_creds *in_cred, struct credentials *v4creds);

DESCRIPTION

     Convert the Kerberos 5 credential to Kerberos 4 credential.  This is done by sending them to the 524 service in the KDC.

     krb524_convert_creds_kdc() converts the Kerberos 5 credential in in_cred to Kerberos 4 credential that is stored in credentials.

     krb524_convert_creds_kdc_ccache() is different from krb524_convert_creds_kdc() in that way that if in_cred doesn't contain a DES session key,
     then a new one is fetched from the KDC and stored in the cred cache ccache, and then the KDC is queried to convert the credential.

     This interfaces are used to make the migration to Kerberos 5 from Kerberos 4 easier.  There are few services that still need Kerberos 4, and
     this is mainly for compatibility for those services.  Some services, like AFS, really have Kerberos 5 supports, but still uses the 524 inter-
     face to make the migration easier.

SEE ALSO

     krb5(3), krb5.conf(5)

HEIMDAL 
							  March 20, 2004							   HEIMDAL