On Wed, 2004-03-10 at 09:33, Howard Chu wrote: > > -----Original Message----- > > From: owner-heimdal-discuss@sics.se > > [mailto:owner-heimdal-discuss@sics.se]On Behalf Of Adam Williams > > > Agree, I'd suspect the LDAP object will almost always exist and the > > kerberos data will be additive. > > > > > > For those things that are new, I think 'account' (or > > another suitable > > > > compatible structural objectClass) is appropriate. > > 'person' to my mind > > > > is not. > > > I take your word for it. But I would feel much better if > > some other ldap > > > literate person spoke up and said what you said was right. > > > > I'm an LDAP administration, and I think he's correct. > > 'account' is the correct objectclass. > > It is not so cut-and-dry; this needs to be a configurable item. There are > plenty of situations where person/inetOrgPerson is the established > objectclass. Also, in an nss_ldap installation the relevant information is in > a posixAccount object which is just an auxiliary class. In practice, this > objectClass is usually associated with a person entry. The generic "account" > objectclass is relatively useless by itself. > > Speaking as a long-time designer of both Kerberos and LDAP and core developer > of OpenLDAP, I'm quite familiar with both... And it is - sort of. If the record already exists in LDAP, then we just add to it. However, I can't see how a KDC can decree that a principal is a 'person', on it's own. So, if you want other than account, then you probably care about your LDAP setup, and are not going to be creating the initial entry with heimdal anyway. (You will add keys with heimdal later). Does this sound reasonable? Andrew Bartlett -- Andrew Bartlett abartlet@pcug.org.au Manager, Authentication Subsystems, Samba Team abartlet@samba.org Student Network Administrator, Hawker College abartlet@hawkerc.net http://samba.org http://build.samba.org http://hawkerc.net
This is a digitally signed message part