[gentoo-server] Pam, Kerberos, SASL, LDAP... which one to use?

[Jose Gonzalez Gomez]

Hi there,

    I'm about to create a central directory service for users in my 
company, I've been reading a lot and right now I think I have a real 
acronym soup headache. My main requirement is to be able to have a 
central repository of users, so if I want to create a new user, I only 
do it in just a place. Creating a new user means giving that user rights 
to use several services (login, mail, proxy,...), so I don't have to 
create a user in /etc/passwd, then create a user in the mail server, ... 
Other requirements include the possibility of using the user information 
as an address book (this is easy as long as the information is stored in 
LDAP).

    Right now I'm using the following (only login and mail tested):

    * PAM + LDAP. Users may login once I have created an entry for that
      user in the LDAP directory.
    * Postfix + SSL + SASL + saslauthd/ldap. Users outside my local
      network are able to send mails to the world once they have
      authenticated. Postfix also uses the information stored in LDAP to
      accept incoming mail.
    * Courier-IMAP + SSL + LDAP authentication. Users are able to access
      their IMAP mailboxes after they have authenticated using the
      information stored in the LDAP server. I'm thinking about
      migrating this to Cyrus IMAP + SSL + SASL + saslauthd/ldap to
      mimic the postfix setup.

    I then found information about kerberos, so I don't know if I should 
go that way, or stay with this setup (this is the time to experiment, 
once this is put into production I won't have the possibility to change 
it easily). Are there any advantages of using kerberos over using just 
SSL + LDAP? In case I use kerberos, would I have duplicate information 
in the kerberos database and in LDAP? May I use LDAP as a backend for 
the kerberos password database? I don't know that much about kerberos, 
so forgive me if I'm making any stupid question.

    Thanks in advance, regards
    Jose