Red Hat

Hi,

I'm considering implementing pam_krb5 on RHEL 5.5 and Solaris 10, and I'm in an environment that has a number of legacy NIS domains. They've all been migrated into Active Directory, RFC2307, with the NIS maps that differed in each domain kept within its own container. However, users and groups have been merged together.

This now lends itself to an interesting problem. Some users have clashing UIDs. User 'joe' might login to a machine in domain 'A' and should rightly have UID 120. However, when 'joe' logs into a machine in domain 'B' he's going to need a UID of say 140. Same username, different UID.

We need a way of overriding the UID, GID, home directory and login shell for particular users on a domain-by-domain basis. I've seen this done with commercial products using GPOs in AD, and I'm guessing, some funky pam_krb5 code?

Can anyone think of either a) how we might achieve this using features already available in one or other pam_krb5, or b) if I have to hack someone's pam_krb5 to do this which one I should pick and which features this might be most similar to?

I'm a C whizz, so don't mind hacking a solution, but would rather not re-invent the wheel.

Thanks,
Mark.

p.s. it's not possible to clean up the data (too big a problem).