LDAP backend on Ubuntu 10.4 (lucid)

Setting up Kerberos v1.9 with LDAP backend on Ubuntu 10.4 (Lucid Lynx)

Prerequisites

Install the following packages: slapd, ldap-utils and libldap2-dev

You can install the necessary packages with these commands:

sudo apt-get install slapd
sudo apt-get install ldap-utils
sudo apt-get install libldap2-dev

Extend the user schema using schemas from standart OpenLDAP distribution: cosine, mics, nis, inetcomperson

ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/mics.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetcomperson.ldif

Building Kerberos from source

./configure --with-ldap
make
sudo make install

Setting up Kerberos

Configuration

Update kdc.conf with the LDAP back-end information:

[realms]
    EXAMPLE.COM = {
        database_module = LDAP
    }

[dbmodules]
    LDAP = {
        db_library = kldap
        ldap_kerberos_container_dn = cn=krbContainer,dc=example,dc=com
        ldap_kdc_dn = cn=admin,dc=example,dc=com
        ldap_kadmind_dn = cn=admin,dc=example,dc=com
        ldap_service_password_file = /usr/local/var/krb5kdc/admin.stash
        ldap_servers = ldapi:///
    }

Schema

From the source tree copy src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema into /etc/ldap/schema

Warning: this step should be done after slapd is installed to avoid problems with slapd installation.

To convert kerberos.schema to run-time configuration (cn=config) do the following:

  1. Create a temporary file /tmp/schema_convert.conf with the following content:

    include /etc/ldap/schema/kerberos.schema

  2. Create a temporary directory /tmp/krb5_ldif.

  3. Run:

    slaptest -f /tmp/schema_convert.conf -F /tmp/krb5_ldif

    This should in a new file named /tmp/krb5_ldif/cn=config/cn=schema/cn={0}kerberos.ldif.

  4. Edit /tmp/krb5_ldif/cn=config/cn=schema/cn={0}kerberos.ldif by replacing the lines:

    dn: cn={0}kerberos
cn: {0}kerberos

    with

    dn: cn=kerberos,cn=schema,cn=config cn: kerberos

    Also, remove following attribute-value pairs:

    structuralObjectClass: olcSchemaConfig
entryUUID: ...
creatorsName: cn=config
createTimestamp: ...
entryCSN: ...
modifiersName: cn=config
modifyTimestamp: ...

  5. Load the new schema with ldapadd (with the proper authentication):

    ldapadd -Y EXTERNAL -H ldapi:/// -f  /tmp/krb5_ldif/cn=config/cn=schema/cn={0}kerberos.ldif

    which should result the message adding new entry "cn=kerberos,cn=schema,cn=config".

Create Kerberos database

Using LDAP administrator credentials, create Kerberos database and master key stash:

kdb5_ldap_util -D cn=admin,dc=example,dc=com -H ldapi:/// create -s

Stash the LDAP administrative passwords:

kdb5_ldap_util -D cn=admin,dc=example,dc=com -H ldapi:/// stashsrvpw cn=admin,dc=example,dc=com

Start krb5kdc:

krb5kdc

To destroy database run:

kdb5_ldap_util -D cn=admin,dc=example,dc=com -H ldapi:/// destroy -f

Useful references