Thanks to Buchan Milne, I'm looking into the Active Directory Password Cache overlay for OpenLDAP, which seems to offer more or less what I'm trying to do.  Is anyone here experienced with it?  Is this the right place to ask or is there an openLDAP overlays list?

I understand this description of ADPC:
 
Active Directory Password Cache
===============================


Active Directory does not provide any means to read user credentials on any
public
API. It is possible, to install additional libraries as password sniffer to
catch and forward cleartext passwords on changes. In case you cannot or simply
dont
want to install such libraries, the Active Directory Password Cache overlay
is your option.

The Active Directory Password Cache overlay allows to mirror user account
credentials without any modification on the AD server. It only takes one
occasional simple bind authentication against the OpenLDAP server.

If the credential has not been mirrored yet, the overlay uses the
krbPrincipalName
and the password provided by the user to perform a Kerberos init against the
Active Directory. A successful Kerberos init guarantees a correct password for
this principal, and therefor the bind finally succeeds.

Within this overlay operation, the password gets encrypted with the default
OpenLDAP hash alorithm and stored as userPassword attribute. There is an option
to update the sambaNTPassword also (using code borrowed from Howard Chu's
smbk5pwd overlay). All following simple bind authentications will first try
these cached credentials, making the OpenLDAP server independent from AD.

In case the user changes its password on the Active Directory server, the old
password stays valid in OpenLDAP until the user first presents the new password
for an simple bind. Within this bind operation, the overlay performs another
Kerberos init and updates the cached credentials in OpenLDAP.
It is clear to me that after a password change, that a failure to authenticate initiates a new auth attempt against the KDC, and if it succeeds, ADPC caches the passwd as a hash in OpenLDAP.  But if Samba fails to authenticate against the hash stored in sambaNTPassword, is a new authentication attempt made against the KDC?  And if it does, where does it get the passwd to hash (since Samba never gets the passwd in NTLM authentication)?

Practically speaking, it seems that the password that the overlay hashes has to come from a source other than Samba.  A web app?  How have people used it in the past? 

W.
--

Wes Modes
Server Administrator & Programmer Analyst
McHenry Library
Computing & Network Services
Information and Technology Services
459-5208