My organization was using 389 Directory Server
LDAP
up until now to manage authentication. I was tasked with switching to Kerberos
for that purpose but I still want to keep LDAP
for non-auth relevant data.
My problem lies in seeding the existing users.
As I understand it, LDAP
keeps the hashed password but Kerberos
generates a key based on a plain text password when a user is created. Is there a way to use the hashed password instead? I know it's possible in LDAP
.
A friend ran into a similar problem and his solution was to capture the user/plain-text password request on every auth attempt and use that information to seed his Kerberos
database for a few months (to get all 'active' users) but that poses some security risks.
Another option would be to send a massive email to all users forcing them to reset their password but I'd rather avoid that.
Is there a better way?