Re: [gentoo-server] manging windows

[Georges Toth]

Hi,

Thanks for that description and links.
I guess I will play with SSO sometime soon :-).

> I have a system setup using OpenLDAP combined with Cyrus-SASL and Heimdal
> kerberos.  I have tied samba into it, and will eventually setup samba-tng
> as an authentication head for samba.  With samba, I may use NTLM
> authentication to include more options for SSO.
>
> The way my setup works is samba has access to use LDAP for accounting and
> simple binds (over SSL/TLS).  Unfortunately, samba doesn't support kerberos
> based authentication "(yet)".  In this setup, the users sign on to their
> desktop, and the same login is used to access network shares without prompt
> for another password (this happens by default on most windows desktops)
> using NTLM.
>
> Various applications using SPEGNO/GSSAPI can provide autologin
> functionality using this same login if we chose to implement something to
> that effect, but that depends entirely on the applications we might use.
> For example, IE and Firefox support SPEGNO/GSSAPI, so enabled web
> applications may use this to authenticate the client without additional
> credentials.  Another example may be squid, as it provides NTLM
> authentication mechanisms.
>
> Even if kerberos or NTLM authentication isn't possible I can still
> integrate other services such as pam, Jabber, samba, AND Outlook
> addressbook into LDAP using SSL/TLS and simple binds.  This makes my setup
> more of a flexible centralized authentication system, than simply an SSO
> server.  In the end, it all comes down to what auth mechanisms the apps
> you're using support in your ability to perform SSO.
>
> I have referenced a lot of these links for my setup.  With them, there
> should be enough information to create a setup truly exact to your needs:
>
> Centralized authentication howtos:
> http://www.openinput.com/auth-howto/
> http://www.bayour.com/LDAPv3-HOWTO.html
>
> Samba (TNG) and authentication:
> http://www.mami.net/univr/tng-ldap/howto/
> http://www.deschner.de/gd/dual_samba.html
> http://www.mami.net/univr/tng-ldap/howto/sambausermapping.html
> http://www.samba-tng.org/docs/tng-arch/tng-arch.html
>
> Other misc resources:
> http://acctsync.sourceforge.net/
> http://www.cmf.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html
> "Making the big boys play nice..." (one of my favorites)
> http://pgina.xpasystems.com/?page_id=3
>
>
> In a sense, I have been trying to work toward SSO for a while. There are
> still many things that require a password on our network though.  By
> centralizing authentication, I feel that I am one step closer.  Anyway, I
> hope this helps.
>
> Regards,
>
>
> Robert Larson

-- 

regards,
Georges Toth
-- 
gentoo-server@g.o mailing list