AD Group Policy Management and Kerberos / LDAP Post: 302955787

Sponsored Content

Top Forums UNIX for Advanced & Expert Users AD Group Policy Management and Kerberos / LDAP Post 302955787 by bakunin on Monday 21st of September 2015 02:26:08 PM

09-21-2015

Registered User

As you have already noticed what M$$ calls "AD" is in fact a LDAP domain with a Kerberos 5 authentication frontend.

This sounds like every system able to participate in an LDAP domain and with an available Kerberos client should be able to participate, but alas this is not true.

LDAP knows "entities", which are defined by the properties they possess (like a table definition in a database with the fields as properties). LDAP itself does not prescribe this structure (this in fact is part of the configuration of an LDAP domain and one of the reasons why this is best left to experts in the field - you can easily end up with a structure that is nearly impossible to handle in practice) but implementations such as M$$ AD does exactly that. So, in fact it is a prefabricated LDAP domain with every ounce of expandability and configuratbility carefully wrung out so that it will not work with anything else than the graphical computer virus sold in Redmond.

Especially the properties of "login shell" and "home directory", which are not necessary in Windows but in any UNIX(-like) OS are left out and you are no allowed to put them in - or lose any support there might be. Microsoft claims that you are using their (cough) product out of spec in this case. The company i work ATM for is actually in exacly this position.

Our solution (which is far from being commendable) is to manage user accounts manually on the AIX systems and just do the authentication part via Kerberos.

To use Kerberos 5 on an AIX client install the "krb5.client.*" and the "krb5.lic" packages available for AIX. Kerberos configuration is done either by hand (/etc/krb5/krb5.conf) or using the command mkkrb5clnt.

Then define users using the "Krb5Files" as "registry" and "system"-properties:

Code:

chuser registry=Krb5Files system=Krb5Files <username>

Similar for "mkuser", etc..

I hope this helps.

bakunin

/PS: if found this IBM link but have no experience with this. You will simply have to try it. I would love to hear from your experience, though.

This User Gave Thanks to bakunin For This Post:

bakunin

View Public Profile for bakunin

Find all posts by bakunin

7 More Discussions You Might Find Interesting

1. HP-UX

LDAP/Kerberos Issue

I am getting the following error message when trying to login to the client: while verifying tgt If I move the /etc/krb5.keytab out of /etc, it works fine. This is HP-UX v23 Does anyone have any ideas?

2. AIX

Kerberos and LDAP Auth

Good day I am trying to configure Kerberos and LDAP authentication on AIX 5.3 with Windows 2003 R2 but something is not quite right. When I ran kinit username I get a ticket and I can display it using klist. When the user login I can see the ticket request on Windows 2003, but the user...

3. UNIX for Advanced & Expert Users

Compiling Samba from Source on AIX, Active Directory, LDAP, Kerberos

Hello, I asked this question in the AIX subforum but never received an answer, probably because the AIX forum is not that heavily trafficked. Anyway, here it is.. I have never had any issues like this when compiling applications from source. When I try to compile samba-3.5.0pre2, configure runs...

4. Solaris

how to assign group policy to user in solaris

hi, how to assign group policy to user in solaris

5. Windows & DOS: Issues & Discussions

QOS packet scheduler and group policy

hi, did anyone know how to configure a priority of dns ports (and other ports) on QOS on windows 2003? hard to understand the group policy "explain" tab on 'qos packet scheduler', no elaboration on how to use it. thanks for any comment you may add. ---------- Post updated at 05:03 PM...

6. Solaris

LDAP Problem during Kerberos setting for Win server 03 Active Directory

Hi, FYI, I'm new in Solaris I'm trying to use Kerberos on authenticating LDAP Client with the Active Directory on Windows Server 2003 on both Solaris 10 5/08 and Solaris 10 9/10 by referring to the pdf file kerberos_s10.pdf available at sun official site. ...

7. AIX

Trouble with Kerberos/LDAP and AIX 6.1

The KRB5ALDAP compound load module is giving me fits. Everything looks like it should be working, but no. Goal: Integrate AIX host with Active Directory using a KRB5ALDAP compound load module so that users can be created in AD and used in AIX, with unix attributes (registry values) being...

LEARN ABOUT DEBIAN

sssd_krb5_locator_plugin

SSSD_KRB5_LOCATOR_PL(8) 					 SSSD Manual pages					   SSSD_KRB5_LOCATOR_PL(8)

NAME

       sssd_krb5_locator_plugin - the configuration file for SSSD

DESCRIPTION

       The Kerberos locator plugin sssd_krb5_locator_plugin is used by the Kerberos provider of sssd(8) to tell the Kerberos libraries what Realm
       and which KDC to use. Typically this is done in krb5.conf(5) which is always read by the Kerberos libraries. To simplify the configuration
       the Realm and the KDC can be defined in sssd.conf(5) as described in sssd-krb5.conf(5)

       sssd(8) puts the Realm and the name or IP address of the KDC into the environment variables SSSD_KRB5_REALM and SSSD_KRB5_KDC respectively.
       When sssd_krb5_locator_plugin is called by the kerberos libraries it reads and evaluates these variables and returns them to the libraries.

NOTES

       Not all Kerberos implementations support the use of plugins. If sssd_krb5_locator_plugin is not available on your system you have to edit
       /etc/krb5.conf to reflect your Kerberos setup.

       If the environment variable SSSD_KRB5_LOCATOR_DEBUG is set to any value debug messages will be sent to stderr.

SEE ALSO

       sssd-krb5(5), sssd.conf(5), sssd(8)

AUTHORS

       The SSSD upstream - http://fedorahosted.org/sssd

SSSD
								    03/04/2013						   SSSD_KRB5_LOCATOR_PL(8)