apacheds 之 kerberos

dn: ou=servicePrincioals,o=users,dc=example,dc=com
objectClass: organizationalUnit
objectClass: top
ou: servicePrincioals

dn: uid=krbtgt,ou=servicePrincioals,o=users,dc=example,dc=comobjectClass: organizationalUnit
objectClass: uidObject
objectClass: krb5KDCEntry
objectClass: krb5Principal
objectClass: top
krb5KeyVersionNumber: 1
krb5PrincipalName: krbtgt/SOUCHE.COM@SOUCHE.COM
ou: TGT
uid: krbtgt
userPassword:: e1NTSEF9bkE3Njl4dlZqUkFHZStUZU95bE5xUHJmNC9aTFhHOVdCQm9PWmc9P

添加用户信息

dn: uid=test,o=users,dc=example,dc=comobjectClass: krb5KDCEntry
objectClass: organizationalPerson
objectClass: person
objectClass: inetOrgPerson
objectClass: krb5Principal
objectClass: top
cn: test
krb5KeyVersionNumber: 7
krb5PrincipalName: test@EXAMPLE.COM
sn: test
uid: test
userPassword:: e1NTSEF9bkE3Njl4dlZqUkFHZStUZU95bE5xUHJmNC9aTFhHOVdCQm9PWmc9P

上述密码均可在修改，使用格式为plaintext格式

客户端验证

需要新增配置

/etc/krb5.conf

[libdefaults]
default_realm = EXAMPLE.COM
#下边的认证方式必须要加不然会出现密码错误的提示
default_tkt_enctypes = aes128-cts-hmac-sha1-96 des3-cbc-sha1 des-cbc-md5 aes128-cts des3-cbc-sha1-kd aes128-cts-hmac-sha1-96

[realms]
 SOUCHE.COM = {
#端口为kdc端口，主机为apacheds的设备IP
  kdc = 172.17.41.20:60088
#端口为admin端口
  admin_server = 172.17.41.20:60464
#  acl_file = /etc/krb5kdc/store/kadm5.acl
 }

[domain_realm]
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM

测试方式

kinit test