Intergrate Heimdal's hdb-ldap and Samba

Andrew Bartlett abartlet at
Mon Mar 1 06:16:34 GMT 2004

On Sun, 2004-02-29 at 23:57, Love wrote:
> Andrew Bartlett <abartlet at> writes:
> > Oops - I'll need to learn a bit more about how HDBentry works :-)
> Its more asn1/der. Heimdal's asn1_compile have implicit continuations (...)
> so parsing data is just fine, however it wont be preserved, nor it will the
> kdc properly reject data when it doesn't understand a critical extension.

Would you consider merging my patch if I removed the extra attributes
(which I don't use yet)?

I was considering that the HDBentry in the hemidal database would simply
not change, but that when using LDAP we would present a 'richer'
interface.   Otherwise, your proposal certainly makes sense.

> > Also, I would like to have a 'plaintext password' attribute passed
> > around, so that we can use it in a number of 'password syncronisation'
> > areas.
> That would be possible to solve in the above scheme.
> And indeed, we have talked about doing just that so enctypes can be added
> to users and not requiring them to change their password.

I assume this will be 'off by default' before the security nuts jump all
over you :-)

> > That's not an issue for Samba right now - the NTLM authentication scheme
> > is stuck at MD4 passwords, and is unlikaly to move further than that. 
> > That is what Kerberos is for ;-)
> Ah, ok.
> BTW, I've imported non ldap related parts of your patch.


How much 'samba stuff' are you willing to tolerate in Heimdal?  

For example, once we start updating the 'last change time', we should
also update/honour the 'min password age' and 'must change time'
attributes.  (Ie, query the directory for those properties, and set them
when we update the password).

It is a slippery slope, and I understand why many projects would run and
scream, but I would love to see Heimdal as the KDC companion to Samba.

(but that's simply because your HDB has at least made it sane for me to
do it :-)

Andrew Bartlett

Andrew Bartlett                                 abartlet at
Manager, Authentication Subsystems, Samba Team  abartlet at
Student Network Administrator, Hawker College   abartlet at
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url :

More information about the samba-technical mailing list