Table of Contents
Advertisement
For example, enter the following to add the extensions:
krbldapconfig -i -D cn=admin,o=org -w password -h ldapserver -p 389
Or to remove, enter the following:
krbldapconfig -u -D cn=admin,o=org -w password -h ldapserver -p 389
IMPORTANT: You must manually refresh the LDAP server for the installation changes to take
effect. For more information, refer to
E.1.4 Exporting the Trusted Root Certificate
1 In iManager, click eDirectory Administration > Modify Object to open the Modify Object page.
2 Click Single Object, then select the Server Certificate object of the server.
3 Click OK.
4 Click the Certificates tab, then select Trusted Root Certificate and view the details of the
certificate.
5 Click Export to launch the Certificate Export Wizard.
6 Specify whether you want to export the private key or not, then click Next.
7 Select File in Binary DER Format, then click Next.
8 Click Save the Exported Certificate to a File.
9 Click Close.
E.2 Configuring the SASL-GSSAPI Method
1 The iManager plug-in for SASL-GSSAPI will not work if iManager is not configured to use
SSL/TLS connection to eDirectory. A secure connection is mandated to protect the realm's
master key and principal keys.
By default, iManager is usually configured for SSL/TLS connection to eDirectory. You need to
add the SSL trusted root certificates of the LDAP server that you use for Kerberos
administration to iManager.
For information on configuring iManager with SSL/TLS connection to eDirectory, refer to the
iManager 2.0 Administration Guide (http://www.novell.com/documentation/lg/imanager20/
index.html?page=/documentation/lg/imanager20/imanager20/data/am4ajce.html#bow4dv4).
2 Complete the following procedures in the order given:
2a
Extend the Kerberos
2b
Create a Realm
2c
Create the LDAP Service
2d
Extract a Service Principal Key or Shared Key from
2e
Creating a Service Principal Object in eDirectory.
2f
Associate a Kerberos Principal Name with the User
Section 14.5, "Refreshing the LDAP Server," on page
Schema.
Container.
Principal.
KDC.
Object.
Configuring GSSAPI with eDirectory 625
360.
Advertisement
Table of Contents
