Kerberos 和 LDAP？
我想知道LDAP是否可以使用Kerberos作为数据库类型？我有一个使用 LDAP 的系统，我的 SA 说可以使用 Kerberos 作为 LDAP 数据库类型，我不必进行任何编程更改，但系统更安全！
I would like to know if LDAP can use Kerberos as a database type? I have a system that used LDAP and my SA is saying with can use Kerberos as a LDAP database type and I would not have to make any programming changes but the system is safer!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您可以将 LDAP 与 Kerberos 结合使用。一个最好的例子是 Active Directory。 AD是一个协作工具，包括LDAP、Kerberos、DNS和AD。国家时间规划。
您可以配置 LDAP 来保存 LDAP 用户信息和信息。使用 Kerberos 进行单点登录的用户授权。您可以使用 389-ds 作为 LDAP 并将 Kerberos 与其集成。
您可以检查相同的 http://tech.groups.yahoo.com/ group/linuxvadapav/message/4148 这不包括 kerberos 部分，但您将能够使 LDAP 正常工作。
对于协作套件，您可以使用免费IPA http://freeipa.org/page/Main_Page
You can use LDAP with Kerberos. A best example for the same is Active Directory. AD is a collaborative tools including of LDAP, Kerberos, DNS & NTP.
You can configure LDAP to save LDAP User Information & Use Kerberos for User Authorization for Single Sign On. You can probably use 389-ds as LDAP and integrate Kerberos with it.
You can check this for the same http://tech.groups.yahoo.com/group/linuxvadapav/message/4148 This dont include kerberos part, but you will be able to get LDAP thing working.
For a collaborative suite, you can go for freeIPA http://freeipa.org/page/Main_Page
LDAP 与数据库无关。 LDAP 只是一个协议。
协议定义为：
“......数字消息格式和规则的系统，用于在计算系统和电信中或之间交换这些消息。” http://en.wikipedia.org/wiki/Protocol_(computing)
"轻量级目录访问协议（LDAP；/ˈɛldæp/）是一种用于通过 Internet 协议 (IP) 网络访问和维护分布式目录信息服务的应用程序协议。1 LDAP 根据 ASN.1 定义并使用 BER 传输。"
http://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol
LDAP has NOTHING to do with a database. LDAP is a protocol only.
A protocol is a defined as:
".. a system of digital message formats and rules for exchanging those messages in or between computing systems and in telecommunications." http://en.wikipedia.org/wiki/Protocol_(computing)
"The Lightweight Directory Access Protocol (LDAP; /ˈɛldæp/) is an application protocol for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network.1 LDAP is defined in terms of ASN.1 and transmitted using BER."
http://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol
您可以使用 Kerberos 身份验证来保护对现有 LDAP 数据库的访问。大多数 LDAP 服务器实现都支持通过 SASL API 进行身份验证。 SASL 是身份验证的通用抽象，支持不同的方法。其中一种方法是 GSSAPI，它允许包装 Kerberos 身份验证。例如，这是在 Active Directory 和 FreeIPA 中完成的，它们都允许 Kerberos 身份验证，并将 Kerberos 凭据存储在 LDAP 的用户条目中。
OpenLDAP有一章专门介绍配置基于SASL的身份验证：http://www.openldap.org /doc/admin24/sasl.html
389-ds是另一个流行的开源LDAP服务器，也支持SASL身份验证。您可以在此处详细阅读如何保护对其的访问：https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server/9.0/html/Administration_Guide/SecureConnections.html
上面的 OpenLDAP 和 389-ds 示例假设已经有您的组织中部署的 Kerberos 基础设施。如果您需要部署一个，我建议您查看 FreeIPA，它目前在 Fedora 和 RHEL 衍生品中可用。
You can secure access to existing LDAP database with Kerberos authentication. Most of LDAP server implementations support authentication through SASL API. SASL is a generic abstraction for authentication and supports different methods. One of these methods is GSSAPI which allows wrapping Kerberos authentication. This is, for example, done in Active Directory and FreeIPA, which both allow Kerberos authentication and also store Kerberos credentials within user entries in LDAP.
OpenLDAP has a chapter dedicated on configuring SASL-based authentication: http://www.openldap.org/doc/admin24/sasl.html
389-ds, which is another popular open source LDAP server, also has support for SASL authentication. You can read in detail how to secure access to it here: https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server/9.0/html/Administration_Guide/SecureConnections.html
OpenLDAP and 389-ds examples above assume there is already Kerberos infrastructure deployed in your organisation. If you need to deploy one, I'd recommend to look at FreeIPA, which currently is available in Fedora and RHEL derivatives.