I'm running a small LAN for 5 users with some basic services, e.g., NFSv4 mounts and SOGo groupware. Because it seemed to be a good and easy to implement idea, authentication is a combination of Kerberos (with LDAP backend) and authoritative user data (home directory, shell, etc.) in OpenLDAP. With just 5 users, using an LDAP browser and the command line kadmin
tool to add a new user account was very simple. Now the environment is growing and includes not-so-techsavvy users; tasks like limited account validity now occur more often.
Before it grows to be a major pain, I thought I'd look for best practices for the combination of LDAP + Kerberos for user management. Except - I haven't found any! I can't imagine people either using scripts or adopting Active Directory (specifically in a pure Unix environment)? Isn't there a way to manage users in this scenario with a tool similar to useradd
/userdel
/usermod
?