9:17 a.m.
On 3/8/19 4:58 AM, Janet Houser wrote:
Thanks!
I read that but I can't switch to freeipa since that software doesn
support a hash needed with gsync.
hmmmm...... I wonder if I could sync the user/password DB to freeipa
and then use that to serve out samba shares.....
I don't think FreeIPA generates password hashes outside of the
directory. I'd expect it to store whatever hash you configure 389 DS to
store, if you change that setting directly in the directory service.
On the other hand, I wouldn't recommend syncing password hashes at all.
Google Cloud supports third-party SSO using SAML 2.0. You should be able
to use GCDS to sync your user accounts, and use SAML for authentication.
9:22 a.m.
New subject: Syncing DS 389's userPassword with Samba 4's sambaNTPassword
Thanks for the suggestion about Google Cloud and SAML auth. I'll look
into that.
Cheers,
On 3/8/19 8:17 AM, Gordon Messmer wrote:
On 3/8/19 4:58 AM, Janet Houser wrote:
> Thanks!
>
> I read that but I can't switch to freeipa since that software doesn
> support a hash needed with gsync.
>
> hmmmm...... I wonder if I could sync the user/password DB to
> freeipa and then use that to serve out samba shares.....
I don't think FreeIPA generates password hashes outside of the
directory. I'd expect it to store whatever hash you configure 389 DS
to store, if you change that setting directly in the directory service.
On the other hand, I wouldn't recommend syncing password hashes at
all. Google Cloud supports third-party SSO using SAML 2.0. You should
be able to use GCDS to sync your user accounts, and use SAML for
authentication.
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
--
Dr. J.L. Houser
Senior Systems Administrator
National Solar Observatory
3665 Discovery Drive
Boulder, CO 80303
Office Phone: (303) 735-7357
7:50 p.m.
New subject: Syncing DS 389's userPassword with Samba 4's sambaNTPassword
On 9 Mar 2019, at 01:17, Gordon Messmer
<gordon.messmer(a)gmail.com> wrote:
On 3/8/19 4:58 AM, Janet Houser wrote:
> Thanks!
>
> I read that but I can't switch to freeipa since that software doesn support a
hash needed with gsync.
>
> hmmmm...... I wonder if I could sync the user/password DB to freeipa and then use
that to serve out samba shares.....
I don't think FreeIPA generates password hashes outside of the directory. I'd
expect it to store whatever hash you configure 389 DS to store, if you change that setting
directly in the directory service.
FreeIPA has it’s own password module that “intercepts” the DS password change operation,
and does extra work. It’s quite complex and hard to get ones head around.
So DS still hashes based on configuration (Should be PBKDF2 on 1.4.x, SSHA512 on 1.3.x),
but extra hashes + krb are added/changed in the process, including ipaNTHash if the
adtrust prep was run.
On the other hand, I wouldn't recommend syncing password hashes at all. Google Cloud
supports third-party SSO using SAML 2.0. You should be able to use GCDS to sync your user
accounts, and use SAML for authentication.
Yes, this is a better solution than trying to sync hashes. IIRC googles hash format is
really weak that they accept for sync, so external portal like this is better.
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
—
Sincerely,
William Brown
Software Engineer, 389 Directory Server
SUSE Labs
1899
days inactive
1902
days old
389-users@lists.fedoraproject.org
2 comments
3 participants
participants (3)
-
Gordon Messmer -
Janet Houser -
William Brown