In this procedure, the krbprincipalaux, and krbTicketPolicyAux and krbPrincipalName attributes are associated with the people object class.
This procedure uses the following configuration parameters:
OpenLDAP Server = krb1.example.com
User principal = mre@EXAMPLE.COM
Before You Begin
You must assume the root role. For more information, see Using Your Assigned Administrative Rights in Securing Users and Processes in Oracle Solaris 11.4.
On the OpenLDAP server, repeat this step for each entry.
cat << EOF | ldapmodify -h openldap.example.com \ -D "cn=directory manager,dc=example,dc=com" dn: uid=mre,ou=people,dc=example,dc=com changetype: modify objectClass: krbprincipalaux objectClass: krbTicketPolicyAux krbPrincipalName: mre@EXAMPLE.COM EOF
This example enables searching principal entries in the ou=people,dc=example,dc=com container, as well as in the default EXAMPLE.COM container.
# kdb5_ldap_util -D "cn=directory manager" modify \ -subtrees 'ou=people,dc=example,dc=com' -r EXAMPLE.COM
# kdb5_util dump > dumpfile
# kdb5_ldap_util load -update dumpfile
# kadmin.local -q 'addprinc mre'