[sigmaris]

If anyone was wondering about this, I figured out a way to do it. Firstly, it’s too complicated to get authenticated binding actually working in this setup without an Open Directory server. During the authenticated bind, the client will try and (1) authenticate as a given directory administrator, (2) create an entry for itself in the directory with cn=clientname$, (3) set the password for that entry, then (4) try and extract information from the created entry to set up Kerberos on the client.

Step (1) will fail if only GSSAPI authentication is allowed for a directory administrator (Apple’s DS LDAPv3 plugin doesn’t seem to support this), and even if other auth. methods are allowed, (3) will run into trouble as if it doesn’t find an AuthenticationAuthority record on the computer entry containing ApplePasswordServer, it’ll fall back to setting the password for the computer entry using an LDAP modify password operation, which will normally fail since the schema doesn’t allow putting a userPassword attribute on a computer entry. Even if you edit the schema to allow it, (4) won’t really work as there will be no information on the computer record telling the client how to set up Kerberos (I assume this is added by some interaction with the Password Server and KDC on a real Open Directory server).

Instead, you can work around the lack of binding support by adding the OpenLDAP server config to the client in Directory Utility as normal (i.e. without ‘authenticated binding’), ticking the “Use authentication when connecting” box and filling in the client machine’s DN and a password (20+ random characters). Also check the “Disable clear text passwords”, “Block man-in-the-middle attacks”, “Digitally sign all packets” and “Encrypt all packets” as necessary. On the KDC, create a Kerberos principal for host/clientmachine@REALM as normal, but instead of giving it a random key, give it the same password as you entered in Directory Utility. Then, (and this is the step I was missing before), close Directory Utility and edit the file /Library/Preferences/DirectoryService/DSLDAPv3PlugInConfig.plist on the client. Find the dict entry for the OpenLDAP server, it should have “Server Account” and “Server Password” values corresponding to what you entered in Directory Utility. Now, add another key-value mapping to the dict with key “Kerberos Id” and value “host/clientmachine@REALM”.

This should cause the client machine to attempt to get a TGT for the host/clientmachine principal, using the “Server Password” value you entered earlier, and use it to authenticate to the OpenLDAP server before doing any directory access. Unfortunately it doesn’t support getting credentials from a keytab, only password-based credentials.

Hopefully this information will be useful to someone since I can’t find it documented anywhere (apart from the DS LDAPv3 plugin source code which I read to figure this out).

[Author]

Posts