krb5: Import MIT 1.21.3 - src - FreeBSD source tree

diff options


context:
space:
mode:

author	Cy Schubert <cy@FreeBSD.org>	2025-03-19 22:12:25 +0000
committer	Cy Schubert <cy@FreeBSD.org>	2025-03-19 22:12:25 +0000
commit	8f7d3ef26dec89a92ec0665de84a5936310a5574 (patch)
tree	9a465418bd4056bf0d369751320a414eaed29fa4 /doc/html/admin/conf_ldap.html
parent	1a79b20663ca26acc2998b90ea2ff2aefd8af5b1 (diff)

Diffstat (limited to 'doc/html/admin/conf_ldap.html')

-rw-r--r--

doc/html/admin/conf_ldap.html

1 files changed, 41 insertions, 50 deletions

diff --git a/doc/html/admin/conf_ldap.html b/doc/html/admin/conf_ldap.html
index 0e3e4dac794f..c5b390b54adf 100644
--- a/doc/html/admin/conf_ldap.html
+++ b/doc/html/admin/conf_ldap.html

@@ -1,35 +1,26 @@

-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

- "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

+<!DOCTYPE html>

-<html xmlns="http://www.w3.org/1999/xhtml">

+<html>

<head>

- <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

+ <meta charset="utf-8" />

+ <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />

<title>Configuring Kerberos with OpenLDAP back-end — MIT Kerberos Documentation</title>

- <link rel="stylesheet" href="../_static/agogo.css" type="text/css" />

- <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />

- <link rel="stylesheet" href="../_static/kerb.css" type="text/css" />

- <script type="text/javascript">

- var DOCUMENTATION_OPTIONS = {

- URL_ROOT: '../',

- VERSION: '1.21.2',

- COLLAPSE_INDEX: false,

- FILE_SUFFIX: '.html',

- HAS_SOURCE: true,

- SOURCELINK_SUFFIX: '.txt'

- };

- </script>

- <script type="text/javascript" src="../_static/jquery.js"></script>

- <script type="text/javascript" src="../_static/underscore.js"></script>

- <script type="text/javascript" src="../_static/doctools.js"></script>

+ <link rel="stylesheet" type="text/css" href="../_static/pygments.css" />

+ <link rel="stylesheet" type="text/css" href="../_static/agogo.css" />

+ <link rel="stylesheet" type="text/css" href="../_static/kerb.css" />

+ <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>

+ <script src="../_static/jquery.js"></script>

+ <script src="../_static/underscore.js"></script>

+ <script src="../_static/doctools.js"></script>

- </head>

- <body>

+ </head><body>

@@ -61,24 +52,23 @@

- <div class="section" id="configuring-kerberos-with-openldap-back-end">

+ <section id="configuring-kerberos-with-openldap-back-end">

<h1>Configuring Kerberos with OpenLDAP back-end<a class="headerlink" href="#configuring-kerberos-with-openldap-back-end" title="Permalink to this headline">¶</a></h1>

-<li>Make sure the LDAP server is using local authentication

-(<code class="docutils literal">ldapi://</code>) or TLS (<code class="docutils literal">ldaps</code>). See

+<li>Make sure the LDAP server is using local authentication

+(<code class="docutils literal notranslate">ldapi://</code>) or TLS (<code class="docutils literal notranslate">ldaps</code>). See

<a class="reference external" href="https://www.openldap.org/doc/admin/tls.html">https://www.openldap.org/doc/admin/tls.html</a> for instructions on

-configuring TLS support in OpenLDAP.

-</li>

-<li>Add the Kerberos schema file to the LDAP Server using the OpenLDAP

+configuring TLS support in OpenLDAP.</li>

+<li>Add the Kerberos schema file to the LDAP Server using the OpenLDAP

LDIF file from the krb5 source directory

-(<code class="docutils literal">src/plugins/kdb/ldap/libkdb_ldap/kerberos.openldap.ldif</code>).

+(<code class="docutils literal notranslate">src/plugins/kdb/ldap/libkdb_ldap/kerberos.openldap.ldif</code>).

The following example uses local authentication:

-<div class="highlight-default"><div class="highlight"><pre>ldapadd -Y EXTERNAL -H ldapi:/// -f /path/to/kerberos.openldap.ldif

+<div class="highlight-default notranslate"><div class="highlight"><pre>ldapadd -Y EXTERNAL -H ldapi:/// -f /path/to/kerberos.openldap.ldif

</pre></div>

</div>

</li>

-<li>Choose DNs for the <a class="reference internal" href="admin_commands/krb5kdc.html#krb5kdc-8">krb5kdc</a> and <a class="reference internal" href="admin_commands/kadmind.html#kadmind-8">kadmind</a> servers

+<li>Choose DNs for the <a class="reference internal" href="admin_commands/krb5kdc.html#krb5kdc-8">krb5kdc</a> and <a class="reference internal" href="admin_commands/kadmind.html#kadmind-8">kadmind</a> servers

to bind to the LDAP server, and create them if necessary. Specify

these DNs with the ldap_kdc_dn and ldap_kadmind_dn

directives in <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5">kdc.conf</a>. The kadmind DN will also be

@@ -87,31 +77,30 @@ used for administrative commands such as <a class="reference internal" href="adm

authentication to access the LDAP server; see the <a class="reference internal" href="conf_files/kdc_conf.html#dbmodules">[dbmodules]</a>

relations ldap_kdc_sasl_mech and similar.

</li>

-<li>Specify a location for the LDAP service password file by setting

-ldap_service_password_file. Use <code class="docutils literal">kdb5_ldap_util stashsrvpw</code>

+<li>Specify a location for the LDAP service password file by setting

+ldap_service_password_file. Use <code class="docutils literal notranslate">kdb5_ldap_util stashsrvpw</code>

to stash passwords for the KDC and kadmind DNs chosen above. For

example:

-<div class="highlight-default"><div class="highlight"><pre>kdb5_ldap_util stashsrvpw -f /path/to/service.keyfile cn=krbadmin,dc=example,dc=com

+<div class="highlight-default notranslate"><div class="highlight"><pre>kdb5_ldap_util stashsrvpw -f /path/to/service.keyfile cn=krbadmin,dc=example,dc=com

</pre></div>

</div>

Skip this step if you are using SASL authentication and the

mechanism does not require a password.

</li>

-<li>Choose a DN for the global Kerberos container entry (but do not

+<li>Choose a DN for the global Kerberos container entry (but do not

create the entry at this time). Specify this DN with the

ldap_kerberos_container_dn directive in <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5">kdc.conf</a>.

Realm container entries will be created underneath this DN.

Principal entries may exist either underneath the realm container

(the default) or in separate trees referenced from the realm

-container.

-</li>

-<li>Configure the LDAP server ACLs to enable the KDC and kadmin server

+container.</li>

+<li>Configure the LDAP server ACLs to enable the KDC and kadmin server

DNs to read and write the Kerberos data. If

disable_last_success and disable_lockout are both set to

true in the <a class="reference internal" href="conf_files/kdc_conf.html#dbmodules">[dbmodules]</a> subsection for the realm, then the

KDC DN only requires read access to the Kerberos data.

Sample access control information:

-<div class="highlight-default"><div class="highlight"><pre>access to dn.base=""

+<div class="highlight-default notranslate"><div class="highlight"><pre>access to dn.base=""

by * read

access to dn.base="cn=Subschema"

@@ -137,9 +126,9 @@ KDC DN only requires read access to the Kerberos data.

service objects for a realm are changed then this information

should be updated.

</li>

-<li>In <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5">kdc.conf</a>, make sure the following relations are set

+<li>In <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5">kdc.conf</a>, make sure the following relations are set

in the <a class="reference internal" href="conf_files/kdc_conf.html#dbmodules">[dbmodules]</a> subsection for the realm:

-<div class="highlight-default"><div class="highlight"><pre>db_library (set to ``kldap``)

+<div class="highlight-default notranslate"><div class="highlight"><pre>db_library (set to ``kldap``)

ldap_kerberos_container_dn

ldap_kdc_dn

ldap_kadmind_dn

@@ -148,14 +137,14 @@ ldap_servers

</pre></div>

</div>

</li>

-<li>Create the realm using <a class="reference internal" href="admin_commands/kdb5_ldap_util.html#kdb5-ldap-util-8">kdb5_ldap_util</a>:

+<li>Create the realm using <a class="reference internal" href="admin_commands/kdb5_ldap_util.html#kdb5-ldap-util-8">kdb5_ldap_util</a>:

<div>kdb5_ldap_util create -subtrees ou=users,dc=example,dc=com -s

</div></blockquote>

Use the -subtrees option if the principals are to exist in a

separate subtree from the realm container. Before executing the

command, make sure that the subtree mentioned above

-<code class="docutils literal">(ou=users,dc=example,dc=com)</code> exists. If the principals will

+<code class="docutils literal notranslate">(ou=users,dc=example,dc=com)</code> exists. If the principals will

exist underneath the realm container, omit the -subtrees option

and do not worry about creating the principal subtree.

For more information, refer to the section <a class="reference internal" href="database.html#ops-on-ldap">Operations on the LDAP database</a>.

@@ -165,11 +154,10 @@ file. This operation will also create the Kerberos container, if

not present already. This container can be used to store

information related to multiple realms.

</li>

-<li>Add an <code class="docutils literal">eq</code> index for <code class="docutils literal">krbPrincipalName</code> to speed up principal

+<li>Add an <code class="docutils literal notranslate">eq</code> index for <code class="docutils literal notranslate">krbPrincipalName</code> to speed up principal

lookup operations. See

<a class="reference external" href="https://www.openldap.org/doc/admin/tuning.html#Indexes">https://www.openldap.org/doc/admin/tuning.html#Indexes</a> for

-details.

-</li>

+details.</li>

</ol>

</div></blockquote>

With the LDAP back end it is possible to provide aliases for principal

@@ -187,16 +175,18 @@ to the pre-existing krbPrincipalName value), and then add additional

Principal aliases are only returned by the KDC when the client

requests canonicalization. Canonicalization is normally requested for

service principals; for client principals, an explicit flag is often

-required (e.g., <code class="docutils literal">kinit -C</code>) and canonicalization is only performed

+required (e.g., <code class="docutils literal notranslate">kinit -C</code>) and canonicalization is only performed

for initial ticket requests.

-</div>

+</section>

+ <div class="clearer"></div>

</div>

<ul>

<li><a class="reference internal" href="#">Configuring Kerberos with OpenLDAP back-end</a></li>

@@ -253,6 +243,7 @@ for initial ticket requests.

</form>

</div>

</div>

@@ -260,8 +251,8 @@ for initial ticket requests.

- <div class="right" >Release: 1.21.2

+ <div class="right" >Release: 1.21.3

</div>