versuch.net

Apache2 LDAPS Auth Config against eDirectory Create cert directory in apache conf directory: mkdir /etc/apache2/cert Download LDAP cert from eDirectory server and copy to /etc/apache2/cert: cp CA.b64 /etc/apache2/cert/ Create config file /etc/apache2/conf.d/ldaps and add this line: LDAPTrustedGlobalCert CA_BASE64 "/etc/apache2/cert/CA.b64" Edit ssl config file /etc/apache2/sites-enabled/default-ssl and add these lines to protect the directory: Alias /phpmyadmin /usr/share/phpmyadmin/ <Directory "/usr/share/phpmyadmin"> AuthName "Access to phpMyAdmin: Login using LDAP user" AuthType basic AuthBasicProvider ldap AuthLDAPUrl ldaps://ldaps.server.com/ou=IT,o=company?cn Require ldap-user username1 username2 </Directory> Restart apache2: service apache2 restart References : http://think.io/?p=90 http://archive09.linux.com/feature/120050

To create kerberos principal for existing eDirectory user, we need to export the user data from ldap using the tool from http://ldapwiki.willeke.com/wiki/DumpEdirectoryPasswordInformationTool . This tool should be executed using ldap user which has permission to see universal password. Example: java -jar DumpPasswordInformation.jar -h ldap.company.com -Z SSL -p 636 -D cn=admin,o=novell -w adminpassword -dvAL -b "ou=people,o=novell" The tool will create output in the file dumppasswordinformation.ldif. The following script will read from above ldif file and map the existing user with the kerberos principal. This script uses keytab from admin/admin kerberos principal with filename admin.keytab

Server requirement: Novell eDirectory + LDAP. Kerberos Server. Shibboleth IDP with Kerberos Auth Plugin. Client requirement: Kerberos Client. Novell Client. Mozilla Firefox. (Tested browser) Tested Structure: SSO Structure