Authentication against AD KDC

[kyle.harms]

I read at: http://www.macdevcenter.com/pub/a/mac/2003/08/26/active_directory.html?page=2

Another option for integration involves kerberos and alternate user records. Kerberos authentication in Active Directory happens based on sAMAcountName; what we’d think of as short name in Mac OS X. It’s entirely feasible to have a user (jdoe) in Active Directory and a user in Open Directory (jdoe) that both authenticate to the AD’s kdc. Most Administrators don’t consider this since Microsoft sells AD as a single directory product integrating authentication and authorization. The concepts are quite separate, however, and kerberos is actually designed solely as an authentication technology, specifically for use in conjunction with a directory. The process looks something like this:

• Create a special user in AD that can search for sAMAcoutnNames
• Use this user to harvest data for your user list
• Bulk import this list into Open Directory, creating accounts with a RecordName (name in NetInfo-speak) corresponding to the sAMAcountName. You might want to configure this script so that only differences (additions and deletions) are mirrored. This will mean a more stable directory.
• Configure clients for kerberos authentication against the AD KDC.

So that you could have complete control over users on your OD, and only authenticate against the active directory key distribution center. For our setup we find this to be ideal. I have already imported all of the users from the AD into our OD and set their passwords to be empty. How would I go about setting up the kerberos authentication against the AD.

I was able to edit the edu.mit.Kerberos file (on the client) so that I could obtain a ticket from the AD KDC (kinit username). I tried this on our OS X Server (10.3) box and it broke authentication altogether. How do I configure kerberos on our OS X Server so that authentication will still work for users that are specific to our domain and so that users that are replicated in our domain but need to authenticate their passwords from the AD?

Any help would be appreciated, I’m new to kerberos and AD.

~Kyle Harms

[Author]

Posts