Re: Heimdal/OpenLDAP/Samba howto and bugreport

[Christopher <cmaxwell@themanor.net>]

On Fri, 4 Jun 2004, [ISO-8859-2] Gémes Géza wrote:
> What if users are in multiple organizational units: ou=Teachers, 
> ou=Students, etc..
> I'm quite sceptical about the fact, that we could succesfuly implement 
> hdb-ldap on this setup :-(
> What could be important for the future (Samba4=ADServer) this will make 
> it problematic, to have a separate ou=Hosts, ou=Computers, or 
> cn=Computers container.

The sasl-regexp does a first match on multiple entries, so you would need some
sort of distinguished method of naming principals - maybe put teachers into
a separate realm, use host/<hostname> for computer containers, etc.

sasl-regexp host/(.+),cn=GSSAPI,cn=auth
	dc=$1,ou=Hosts,o=bf
sasl-regexp uid=(.+),cn=STAFF.YOUR.REALM,cn=GSSAPI,cn=auth
	uid=$1,ou=Teachers,o=bf
...students, etc...
sasl-regexp uid=(.+),cn=GSSAPI,cn=auth
	uid=$1,ou=People,o=bf

--
Christopher Maxwell
christopher@themanor.net