1. LDAP and Kerberos: An Overview Leveraging services provided by Active Directory for Unix/Linux authentication, authorization and name services Jason Testart Computer Science Computing Facility University of Waterloo March 2007

2. Summary Kerberos is for authentication only and provides Single Sign-on (SSO) LDAP can be used for authentication, authorization, and name services (no SSO) Active Directory is a kerberized directory service with an LDAP interface Use Kerberos for authentication, LDAP for authorization and name services

3. What do these technologies give us? Eliminate password synchronization Speed-up system deployment Reduce development time when a new platform is introduced Improve the end-user experience

4. LDAP Name services using the Lightweight Directory Access Protocol

5. What is LDAP? A protocol for accessing a directory service What’s a directory service? Think DNS. Database backend – do we care? Schema: attributes with OIDs (à la SNMP) Objects organized in a tree structure (DIT) Operations: bind, search, modify LDIF: text file format for describing directory contents

6. Schema Attribute – like a variable in a programming language, it holds a value ObjectClass – a special attribute that all directory entries must have, as it acts as a template for the data (enforces a kind of internal consistency) AD Schema: http://msdn.microsoft.com/library/en- us/ad/ad/active_directory_schema.asp Unix Schema: http://www.ietf.org/rfc/rfc2307.txt

7. Types of Object Classes Structural – only one per entry! Auxiliary – supplements structural Abstract – can’t be used directly; only as an ancestor of another class (eg. “top”)

8. Schema Examples objectclass ( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction of an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) ) attributetype ( 1.3.6.1.1.1.1.3 NAME 'homeDirectory' DESC 'The absolute path to the home directory' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) Snippets of OpenLDAP’s RFC 2307 schema implementation:

9. Directory Information Tree (DIT)

10. DN and RDN of a directory entry RDN – a unique attribute among all siblings of a single parent in the DIT (eg. “uid=jatestar”) DN – concatenation of RDNs when following the path from the entry (node) to the root of the DIT (eg. “uid=jatestar, ou=people, dc=ldap, dc=student, dc=cs, dc=uwaterloo, dc=ca)

11. Directory Entry Example jatestar:x:1449:1449:Jason Testart [CSCF],DC2555B,x37174,,:/u4/jatestart:/xhbin/tcsh dn: uid=jatestar, ou=ldap, ou=people, dc=student, dc=cs, dc=uwaterloo, dc=ca objectClass: top objectClass: person objectClass: posixAccount cn: Jason Testart sn: Testart uid: jatestar uidNumber: 1449 gidNumber: 1449 homeDirectory: /u4/jatestart loginShell: /xhbin/tcsh gecos: Jason Testart [CSCF],DC2555B,x37174,, Entry in /etc/passwd: Becomes the following LDIF:

12. Some LDAP Interfaces LDIF - ldapsearch, ldapmodify, ldp.exe (see “man ldif, man ldapsearch, etc…) Perl - Net::LDAP (see http://ldap.perl.org/) C/C++ - OpenLDAP API (likely others…) (see “man 3 ldap”) ADSI - Windows specific (see http://www.microsoft.com/windows2000/techinfo/howitworks /activedirectory/adsilinks.asp)

13. When interfacing, you need… Server hostname Bind DN Base DN (if searching) SSL? Note: An Active Directory domain controller will accept the value of the userPrincipalName attribute as the binddn. (eg. “jatestar@nexus.uwaterloo.ca” is friendlier than “CN=Jason J Testart (jatestar),OU=CSCF,OU=Staff,OU=Accounts, OU=Computer Science,OU=Faculties,DC=NEXUS,DC=UWATERLOO,DC=CA”)

14. What object classes does AD use for users? ldapsearch -x -W -H "ldaps://canadenis.student.cs.uwaterloo.ca“ \ -D "jatestar@student.cs.uwaterloo.ca" \ -b "dc=student,dc=cs,dc=uwaterloo,dc=ca“ \ "(cn=jatestar)" objectClass Query: Yields: dn: CN=jatestar,OU=Users,OU=CS,DC=student,DC=cs,DC=uwaterloo,DC=ca objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user

15. Need Unix attributes in AD The user objectClass is missing needed attributes that RFC 2307 provides So, extend the schema in AD, but be careful! Differences between MS-SFU-2.0, MS-SFU- 3.5 and schema provided by Windows Server 2003 R2 Maximize use of client attribute mappings!

16. Attribute Mappings Example: “When I ask for the gecos attribute value, fetch the value of cn from the directory instead” Minimize duplication of data in the directory (ie. redundant attributes) In some cases, doing this allows you to avoid extending the schema of a directory

17. Groups posixGroup uses memberUid, which is the uid of the member groupofUniqueNames uses the member attribute, which is the DN of the member Attribute mappings may be inappropriate, redundancy may be unavoidable Netgroups may give additional functionality, with additional complexity

18. Applying the knowledge (client-side) Make sure you know what directory attributes that you are using! Tell /etc/nsswitch.conf to use the nss_ldap library from padl.com Edit the ldap.conf appropriately to point to AD and define the attribute maps No need to add users/groups in /etc/passwd or /etc/group!

19. Kerberos Using Active Directory Kerberos for Unix/Linux authentication

20. What is Kerberos? Authentication protocol Secure SSO Trusted 3 rd party Mutual Authentication

21. Some Kerberos Terminology User Principal Host/Service Principal Instance Realm KDC TGT Credential cache

22. Principals username[/instance]@REALM servicename/FQDN@REALM jatestar@NEXUS.UWATERLOO.CA nfs/gl01.student.cs.uwaterloo.ca@STUDENT.CS.UWATERLOO.CA host/cpu14.student.cs.uwaterloo.ca@STUDENT.CS.UWATERLOO.CA imap/services02.student.cs.uwaterloo.ca@STUDENT.CS.UWATERLOO.CA Examples :

23. Credential Cache (on a Mac) $ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: jatestar@STUDENT.CS.UWATERLOO.CA Valid starting Expires Service principal 12/13/06 01:06:50 12/13/06 11:05:03 krbtgt/STUDENT.CS.UWATERLOO.CA@STUDENT.CS.UWATERLOO.CA renew until 12/14/06 01:06:50 12/13/06 01:06:38 12/13/06 11:05:03 fs02$@STUDENT.CS.UWATERLOO.CA renew until 12/14/06 01:06:50 12/13/06 01:10:23 12/13/06 11:05:03 host/cpu20.student.cs.uwaterloo.ca@STUDENT.CS.UWATERLOO.CA renew until 12/14/06 01:06:50

24. AD Domain == Kerberos v5 Realm Domain controllers provide KDC functionality A “domain” is synonymous with “realm” Joining a Windows computer to a domain means you are creating a host principal in the realm No multipart principal names in AD, so mappings are needed for instances

25. Adding a Unix host to AD Create a user account for the host/service (eg. cpu04-host) Map the account to a service principal: host/cpu04.student.cs.uwaterloo.ca@STUDENT.CS.UWATERLOO.CA Set the account password Generate a krb5.keytab file Stick the keytab file in /etc/krb5 on cpu04 Done on all student.cs CPU servers

26. Adding a Unix host to AD (sans GUI) % ldapmodify -x -W -H ldaps://canadenis -D “Administrator@student.cs.uwaterloo.ca” dn: cn=cpu04-host,OU=Service Principals,DC=student,DC=cs,DC=uwaterloo,DC=ca changetype: add cn: cpu04-host objectClass: user sAMAccountName: cpu04-host displayName: cpu04-host description: Kerberos host service principal for cpu04 userAccountControl: 2097664 ktpass –princ host/cpu04.student.cs.uwaterloo.ca@STUDENT.CS.UWATERLOO.CA –mapuser cpu04-host –password S0m3Rand0mPaZZw0rd –out cpu04-host.keytab Create the account using LDIF (from a Linux box): Do the mapping and generate a keytab file (on the domain controller):

27. Tell Unix login to authenticate against AD Set-up an appropriate /etc/krb5.conf Modify the PAM authentication stack to use the pam_krb5 module

28. Lots of work for simple authentication! Could have used ldap, or radius, etc… Kerberos gives us Single Sign-On Can take advantage of domain trusts! Most apps use SASL and GSSAPI to support Kerberos 5

29. SSH and SSO Configure SSH clients and servers to use GSSAPI for authentication Mac Lab user can ssh to a CPU server without a password (no ssh keys or.shosts required) Honours.k5login file (handy for course accounts) Possibilities with NFS (v3+), IMAP, SMTP AUTH, HTTP, etc…

30. SSO Demo (Linux client to AD) Show krb5.conf Login to realm (kinit) Show file shares on NetApp Query our entry on domain controller Show resulting credential cache (klist) Logout of realm (kdestroy)

31. Using slapd (OpenLDAP) with AD OpenLDAP supports Kerberos via SASL/GSSAPI Can map entities in a realm with entries in the directory Use authz-regexp directive in slapd.conf See: http://www.openldap.org/doc/admin23/sasl.html

32. References LDAP System Administration by Gerald Carter (O’Reilly) Kerberos The Definitive Guide by Jason Garman (O’Reilly) Unified Windows® and UNIX® Authorization Using Microsoft® Active Directory LDAP as a Directory Store by Ellie Berriman (Network Appliance Inc.) Unified Windows® and UNIX® Authentication Using Microsoft® Active Directory Kerberos by Ellie Berriman (Network Appliance Inc.)