System Administration Guide: Security Services

ProcedureHow to Mix Kerberos Principal Attributes in a Non-Kerberos Object Class Type

This procedure allows for Kerberos principal attributes to be associated with non-Kerberos object class types. In this procedure the krbprincipalaux, and krbTicketPolicyAux and krbPrincipalName attributes are associated with the people object class.

In this procedure, the following configuration parameters are used:

  1. Become superuser.

  2. Prepare each entry in the people object class.

    Repeat this step for each entry.

    cat << EOF | ldapmodify -h -D "cn=directory manager"
    dn: uid=willf,ou=people,dc=example,dc=com
    changetype: modify
    objectClass: krbprincipalaux
    objectClass: krbTicketPolicyAux
    krbPrincipalName: willf@EXAMPLE.COM
  3. Add a subtree attribute to the realm container.

    This step allows for searching of principal entries in the ou=people,dc=example,dc=com container, as well as in the default EXAMPLE.COM container.

    # kdb5_ldap_util -D "cn=directory manager" modify \
                -subtrees 'ou=people,dc=example,dc=com' -r EXAMPLE.COM
  4. (Optional) If the KDC records are stored in DB2, migrate DB2 entries.

    1. Dump the DB2 entries.

      # kdb5_util dump > dumpfile
    2. Load the database into the LDAP server.

      # kdb5_util load -update dumpfile
  5. (Optional) Add the principal attributes to the KDC.

    # kadmin.local -q 'addprinc willf'