LDAP backend on Ubuntu 10.4 (lucid) — MIT Kerberos Documentation

# MIT Kerberos Documentation

Contents | previous | next | index | Search | feedback

# LDAP backend on Ubuntu 10.4 (lucid)

Setting up Kerberos v1.9 with LDAP backend on Ubuntu 10.4 (Lucid Lynx)

## Prerequisites

Install the following packages: slapd, ldap-utils and libldap2-dev

You can install the necessary packages with these commands:

    sudo apt-get install slapd
    sudo apt-get install ldap-utils
    sudo apt-get install libldap2-dev

Extend the user schema using schemas from standart OpenLDAP distribution: cosine, mics, nis, inetcomperson

    ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif
    ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/mics.ldif
    ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif
    ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetcomperson.ldif

## Building Kerberos from source

    ./configure --with-ldap
    make
    sudo make install

## Setting up Kerberos

### Configuration

Update kdc.conf with the LDAP back-end information:

    [realms]
        EXAMPLE.COM = {
            database_module = LDAP
        }

    [dbmodules]
        LDAP = {
            db_library = kldap
            ldap_kerberos_container_dn = cn=krbContainer,dc=example,dc=com
            ldap_kdc_dn = cn=admin,dc=example,dc=com
            ldap_kadmind_dn = cn=admin,dc=example,dc=com
            ldap_service_password_file = /usr/local/var/krb5kdc/admin.stash
            ldap_servers = ldapi:///
        }

### Schema

From the source tree copy `src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema` into `/etc/ldap/schema`

Warning: this step should be done after slapd is installed to avoid problems with slapd installation.

To convert kerberos.schema to run-time configuration (`cn=config`) do the following:

1. Create a temporary file `/tmp/schema_convert.conf` with the following content:

       include /etc/ldap/schema/kerberos.schema

2. Create a temporary directory `/tmp/krb5_ldif`.

3. Run:

       slaptest -f /tmp/schema_convert.conf -F /tmp/krb5_ldif

   This should in a new file named `/tmp/krb5_ldif/cn=config/cn=schema/cn={0}kerberos.ldif`.

4. Edit `/tmp/krb5_ldif/cn=config/cn=schema/cn={0}kerberos.ldif` by replacing the lines:

       dn: cn={0}kerberos
       cn: {0}kerberos

   with

   > dn: cn=kerberos,cn=schema,cn=config cn: kerberos

   Also, remove following attribute-value pairs:

       structuralObjectClass: olcSchemaConfig
       entryUUID: ...
       creatorsName: cn=config
       createTimestamp: ...
       entryCSN: ...
       modifiersName: cn=config
       modifyTimestamp: ...

5. Load the new schema with ldapadd (with the proper authentication):

       ldapadd -Y EXTERNAL -H ldapi:/// -f  /tmp/krb5_ldif/cn=config/cn=schema/cn={0}kerberos.ldif

   which should result the message `adding new entry "cn=kerberos,cn=schema,cn=config"`.

## Create Kerberos database

Using LDAP administrator credentials, create Kerberos database and master key stash:

    kdb5_ldap_util -D cn=admin,dc=example,dc=com -H ldapi:/// create -s

Stash the LDAP administrative passwords:

    kdb5_ldap_util -D cn=admin,dc=example,dc=com -H ldapi:/// stashsrvpw cn=admin,dc=example,dc=com

Start krb5kdc:

    krb5kdc

To destroy database run:

    kdb5_ldap_util -D cn=admin,dc=example,dc=com -H ldapi:/// destroy -f

## Useful references

- Kerberos and LDAP