Re: LDAP authentication and authorization using Debian and Active Directory

Dne středa 16. června 2021 8:41:20 CEST, Luca Olivetti napsal(a):
> El 16/6/21 a les 0:04, Vladislav Kurz ha escrit:
> > Hello,
> > 
> > I have several working Cyrus installations authenticated against AD, but I
> > do not use LDAP. Instead it authenticates via kerberos. To be more
> > precise: Cyrus/Exim -> Saslauthd -> PAM -> pam_krb5.so -> AD
> 
> Is there some advantage using pam_krb5 instead of pam_ldap/pam_winbind
> or "saslauthd -a ldap"?

Easy configuration, just set up /etc/krb5.conf

[libdefaults]
        default_realm = YOURREALM

[realms]
        YOURREALM = {
                kdc = 192.168.x.x
        }

If you set your DNS properly to resolve YOURREALM in DNS, you are fine with 
just the [libdefaults] section. Then just check if login works with kinit.
Originally I tried LDAP, and failed too. This worked flawlessly.

> > For distribution groups, aliases and such stuff I use LDAP queries in
> > Exim. But kerberos for authentication
> > 
> > Unfortunately kerberos does not give you groups. Maybe you could use
> > winbind and libnss-winbind to get groups from AD to Linux and use them as
> > if they were in /etc/group...
> 
> that's what I do, but then I don't have many active users and my DC is
> samba not windows (though that shouldn't matter as long as the mail
> server is joined to the domain).

I did not try pam_winbind. (I do not need groups for mail access).
If you already have winbind working, surely try pam_winbind

-- 
Best Regards
        Vladislav Kurz




------------------------------------------
Cyrus: Info
Permalink: https://cyrus.topicbox.com/groups/info/T1c604a219c5fa805-M9a36295e2c27ba6956064e12
Delivery options: https://cyrus.topicbox.com/groups/info/subscription