You can perform the following Kerberos operations:
This section discusses the following:
Use the Kerberos Administration tool that is available with your KDC to create the eDirectory service principal with the encryption type and salt type as AES256-CTS and Normal, respectively.
The name of the principal must be ldap/MYHOST.MYDNSDOMAIN@REALMNAME.
For example, if you are using MIT KDC, execute the following command:
kadmin:addprinc -randkey -e aes256-cts:normal ldap/server.novell.com@MITREALM
IMPORTANT:The hostname of service principal created must be in lowercase. Authentication fails if the hostname is in uppercase. For example, if the hostname is myHost.com, the hostname syntax of the LDAP service principal should look like ldap/myhost.com@<realmname>.
All the keys should be preferably of type AES256.
Change the LDAP service principal keys regularly. Whenever you change the LDAP service principal keys, ensure that you update the principal object in eDirectory.
Use the Kerberos Administration tool that is available with your KDC to extract the key of the LDAP service principal created in Creating a Service Principal for an LDAP Server, then store it in the local file system. This can be done with the help of your Kerberos administrator.
For example, if you are using an MIT KDC, execute the following command:
kadmin: ktadd -k /directory_path/keytabfilename -e aes256-cts:normal ldap/server.novell.com@MITREALM
For example, if you are using Microsoft KDC, create a user ldapMYHOST in Active Directory and then execute the following command:
ktpass -princ ldap/MYHOST.MYDNSDOMAIN@MYREALM -mapuser ldapMYHOST -pass mypassword -out MYHOST.keytab
This command maps the principal (ldap/MYHOST.MYDNSDOMAIN@MYREALM) to the user account (ldapMYHOST), sets the host principal password to mypassword, and extracts the key into the MYHOST.keytab file.