<div dir="ltr">I'm not so sure the final samba4 will still ship with their own kdc, I think I heard otherwise. But this setup of yours if surely interesting! It's great that you're finding AFS of production quality<br>
Regards<br><br><div class="gmail_quote">On Tue, Aug 12, 2008 at 2:50 PM, Angel Marin <span dir="ltr"><<a href="mailto:anmar@anmar.eu.org">anmar@anmar.eu.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
We sync freeipa groups with openafs groups and memberships (simple script) so permissions are managed as a regular openafs thing. openafs client honors those perms just fine based on the logged in principal. So 'local' users are only used for the workstation login, no need to use windows groups for anything :)<br>
<br>
They still can't create local shared folders in the regular way, but if everything is in the afs cell, every user can have folders with access granted to whoever they (or you) want. It's just a training problem :)<br>
<br>
In the broad sense it feel like a more convoluted setup, but it's order of magnitude nicer/easier to have linux home dirs on the same file servers as the windows ones while everyone is authenticating to a single freeipa realm :) Having the flexibility & network caching performance of openafs gives great value for remote & home offices setups too; but YMMV :)<br>
<br>
Considering Samba4 ships with it's own ldap-server implementation and doesn't work with a regular MIT kdc AFAIK, I'm not sure it would be cleaner in any way ;)<br>
<br>
Ahmed Kamal wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d">
I played with pGina before, it was great, but the only limitation I faced was that Windows does not "see" other users and groups. Logged in users are created to be "local" users, which means one can't created shared folders, and apply permissions and such. Is this resolved by using open-afs (I've never touched that) ? If so, that would really rock! I'd even prefer that to a samba4 solution!<br>
<br></div><div><div></div><div class="Wj3C7c">
On Tue, Aug 12, 2008 at 1:40 PM, Christian Horn <<a href="mailto:chorn@fluxcoil.net" target="_blank">chorn@fluxcoil.net</a> <mailto:<a href="mailto:chorn@fluxcoil.net" target="_blank">chorn@fluxcoil.net</a>>> wrote:<br>
<br>
On Tue, Aug 12, 2008 at 11:43:14AM +0200, Angel Marin wrote:<br>
> (sorry for the off-topic, but it might be of interest for people<br>
> planning on moving to freeipa)<br>
<br>
Seeing what you implemented i guess it fits to @freeipa :)<br>
<br>
<br>
> We do auth through a home made pGina plugin that does kerberos<br>
auth and<br>
> ensures openafs (roaming profiles and user dirs are in the afs<br>
cell) is<br>
> ready; looking up user info in ldap, ensuring clock is in sync and<br>
> enabling password change are in the works. Finally kfw and openafs<br>
> integrated logon plugin takes care of actual tickets for user<br>
session so<br>
> there's SSO*.<br>
><br>
> We've had to patch pGina too as stock one was crashing on us.<br>
Once we've<br>
> been able to polish all the quirks (currently sometimes users are<br>
> randomly denied access to afs cell on first login) we'll release code<br>
> and docs somewhere :)<br>
<br>
Great.<br>
<br>
<br>
> * Biggest issue with SSO is that it'll only work with apps capable of<br>
> talking to kfw (firefox, thunderbird, openafs-client, ...), but<br>
that's<br>
> not a problem around here. In theory with Vista clients kfw is<br>
capable<br>
> of writing to system ccache (enabling SSO on IE and the like) but we<br>
> haven't tried it here.<br>
<br>
I did look into running an AD-domain and having it crosstrusting the<br>
kerberosrealm, corporations do not lose the microsoft-support that way<br>
(what if $stuff happens!) and authentication also from IE works, see<br>
<a href="http://fluxcoil.net/files/sso_crossrealm_kerberos.htm" target="_blank">http://fluxcoil.net/files/sso_crossrealm_kerberos.htm</a> .<br>
Having no AD server around like in your solution ofcourse feels<br>
much more convienient.<br>
Samba4 should be able to play that role in future.<br>
<br>
<br>
Christian<br>
<br>
_______________________________________________<br>
Freeipa-devel mailing list<br></div></div>
<a href="mailto:Freeipa-devel@redhat.com" target="_blank">Freeipa-devel@redhat.com</a> <mailto:<a href="mailto:Freeipa-devel@redhat.com" target="_blank">Freeipa-devel@redhat.com</a>><div class="Ih2E3d"><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-devel" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-devel</a><br>
<br>
<br>
</div></blockquote>
<br><div><div></div><div class="Wj3C7c">
<br>
-- <br>
Angel Marin<br>
<a href="http://anmar.eu.org/" target="_blank">http://anmar.eu.org/</a><br>
</div></div></blockquote></div><br></div>