On Fri, 2008-08-29 at 15:14 +1000, Nazeeruddin Mohammad wrote:
Sorry, I couldn't pass the message properly. We want to use openldap, as many services depend on it. However, we want to synchronize LDAP user accounts with that of on AD. This means users need remember only one password
I heard that there is possibility of doing this through openldap's proxy feature.
Could any enlighten me how to accomplish this? Or, is there any other way of doing this?
Here is my sladp.conf snippet
Perhaps put set the userPassword attribute to {SASL}user@AD.DOMAIN and have SASL handle the forwarding of the simple binds into kerberos kinit requests?
(I did this, to a bundled Heimdal many years ago, I don't know if it works how you want however).
Otherwise, perhaps look for a redirection via PAM to winbindd or pam_krb5?
Andrew Bartlett