First, create the file /data/ds/shared/bin/gssapi.ldif to define the mapping that should be used by the Directory Server, and to identify which Kerberos user is authenticating, based on the Principal. Create the file contents to be the same as what is shown in the following example.
dn: cn=GSSAPI,cn=identity mapping,cn=config changetype: add objectClass: top objectClass: nsContainer cn: GSSAPI dn: cn=default,cn=GSSAPI,cn=identity mapping,cn=config changetype: add objectClass: top objectClass: nsContainer objectClass: dsIdentityMapping objectClass: dsPatternMatching cn: default dsMatching-pattern: \${Principal} dsMatching-regexp: (.*)@EXAMPLE.COM dsMappedDN: uid=\$1,ou=People,dc=example,dc=com dn: cn=SASL,cn=security,cn=config changetype: modify replace: dsSaslPluginsPath dsSaslPluginsPath: /usr/lib/mps/sasl2/libsasl.so |
Next, use the ldapmodify command to update the Directory Server to enable GSSAPI with the appropriate mappings, as shown in the following example:
$ ldapmodify -D cn=admin,cn=Administrators,cn=config -w - -a -f /data/ds/shared/bin/gssapi.ldif adding new entry cn=GSSAPI,cn=identity mapping,cn=config adding new entry cn=default,cn=GSSAPI,cn=identity mapping,cn=config modifying entry cn=SASL,cn=security,cn=config $ |