This is a discussion on Re: Principal attributes and policy in LDAP Realm - Kerberos ; On Jun 9, 2008, at 04:52, Savitha R wrote: >>>> On Sat, Jun 7, 2008 at 1:46 AM, in message > , Klaus Heinrich Kiwi > wrote: >> Hi, >> >> I hav some questions regarding how data is organized ...
On Jun 9, 2008, at 04:52, Savitha R wrote:
>>>> On Sat, Jun 7, 2008 at 1:46 AM, in message
> <firstname.lastname@example.org>, Klaus Heinrich Kiwi
>> I hav some questions regarding how data is organized when using the
>> LDAP KDB plugin for a realm. I hope this is the right place to ask.
>> I have a Realm set-up using the LDAP backend. First thing is: when
>> querying a principal using kadmin, why attributes such as 'Last
>> [successful,failed] authentication' and 'Failed password attempts'
>> never filled-up? After failing some authentication attempts I have
>> Last modified: Fri Jun 06 16:24:09 BRT 2008 (klaus/admin@MYREALM)
>> Last successful authentication: [never]
>> Last failed authentication: [never]
>> Failed password attempts: 0
> These attributes are updated only when the KDC is built with the
> "--with-kdc-kdb-update" option.
Which, unfortunately, doesn't seem to work since the DAL merge that
made the use of LDAP possible (e.g., RT tickets 5668, 5716 -- the
latter has a patch I haven't had a chance to evaluate).
This probably should be made a runtime option -- or at least, have the
configure-time option set a flag checked by code that's always