[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Heimdal/OpenLDAP/Samba howto and bugreport

On Fri, 4 Jun 2004, [ISO-8859-2] Gémes Géza wrote:
> What if users are in multiple organizational units: ou=Teachers, 
> ou=Students, etc..
> I'm quite sceptical about the fact, that we could succesfuly implement 
> hdb-ldap on this setup :-(
> What could be important for the future (Samba4=ADServer) this will make 
> it problematic, to have a separate ou=Hosts, ou=Computers, or 
> cn=Computers container.

The sasl-regexp does a first match on multiple entries, so you would need some
sort of distinguished method of naming principals - maybe put teachers into
a separate realm, use host/<hostname> for computer containers, etc.

sasl-regexp host/(.+),cn=GSSAPI,cn=auth
sasl-regexp uid=(.+),cn=STAFF.YOUR.REALM,cn=GSSAPI,cn=auth
...students, etc...
sasl-regexp uid=(.+),cn=GSSAPI,cn=auth

Christopher Maxwell