SLAPO-SMBK5PWD(5)

💖 SLAPO-SMBK5PWD 💖

okay bestie, gather round, because this is the slapo-smbk5pwd page from the File Formats Manual and it's literally the password-sync girlie of the OpenLDAP world. ✨

---

🎀 NAME 🎀

slapo-smbk5pwd — the Samba & Kerberos password sync overlay for slapd. 💅

---

🦋 SYNOPSIS 🦋

ETCDIR/slapd.conf

       include <path to>/krb5-kdc.schema

       include <path to>/samba.schema

       moduleload smbk5pwd.so

        ...

       database mdb

        ...

       overlay smbk5pwd

---

🌸 DESCRIPTION 🌸

So the smbk5pwd overlay for slapd(8) is out here overloading the Password Modify Extended Operation (RFC 3062) — no cap — so that when an LDAP user changes their password, it also updates the Kerberos keys and the Samba password hashes. And because that wasn't enough main character energy, it also updates all the password-change-related attributes for Kerberos, Samba and/or UNIX user accounts. Obsessed. 🔥

The Samba side of things is written using the Samba 3.0 LDAP schema; the Kerberos side is written for Heimdal, using its hdb-ldap backend. iykyk. 💜

Alsooooo, there's a shiny new {K5KEY} password hash mechanism provided. For krb5KDCEntry objects that have this scheme specifier chilling in their userPassword attribute, Simple Binds get checked against the Kerberos keys of the entry. And here's the cute part: no data is needed after the {K5KEY} scheme specifier in the userPassword — it gets looked up from the entry directly. iconic. ✨

---

👑 CONFIGURATION 👑

The smbk5pwd overlay supports these slapd.conf config options, and bestie, they should appear after the overlay directive. put them in the right spot, I'm begging 🙈

• smbk5pwd-enable <module> — lets you enable only the modules you actually want. Legal values for <module> are:
  • krb5 — if the user has the krb5KDCEntry objectclass, update the krb5Key and krb5KeyVersionNumber attributes using the new password from the Password Modify operation — provided the Kerberos account is not expired. (Yes, the original page spells it "Exiration", and no, we're not fixing it, we're just vibing.) Expiration gets determined by evaluating the krb5ValidEnd attribute.
  • samba — if the user is a sambaSamAccount object, synchronize the sambaNTPassword to the password entered in the Password Modify operation, and update sambaPwdLastSet accordingly. slay. 💅
  • shadow — update the attribute shadowLastChange, if the entry has the objectclass shadowAccount.
• By default, all modules compiled in are enabled. Setting this config statement restricts the enabled modules to the ones you explicitly mention. so choose wisely, queen. 🫶

---

• smbk5pwd-can-change <seconds> — if the samba module is enabled and the user is a sambaSamAccount, update the attribute sambaPwdCanChange to point <seconds> into the future — which essentially denies any Samba password change until then. A value of 0 disables this feature.
• smbk5pwd-must-change <seconds> — if the samba module is enabled and the user is a sambaSamAccount, update the attribute sambaPwdMustChange to point <seconds> into the future — essentially setting the Samba password expiration time. A value of 0 disables this feature.

---

Alternatively — because options are a lifestyle — the overlay supports table-driven configuration, which means it can be run-time loaded and configured via back-config. 💖

---

🌈 EXAMPLE 🌈

The layout of a slapd.d based, table-driven configuration entry looks like this, literally copy-paste material:

        # {0}smbk5pwd, {1}mdb, config
        dn: olcOverlay={0}smbk5pwd,olcDatabase={1}mdb,cn=config
        objectClass: olcOverlayConfig
        objectClass: olcSmbK5PwdConfig
        olcOverlay: {0}smbk5pwd
        olcSmbK5PwdEnable: krb5
        olcSmbK5PwdEnable: samba
        olcSmbK5PwdMustChange: 2592000

which enables both the krb5 and samba modules with a Samba password expiration time of 30 days (= 2592000 seconds). math ate. 🧮✨

---

🔍 SEE ALSO 🔍

• slapd.conf(5), ldappasswd(1), ldap(3)
• "OpenLDAP Administrator's Guide" (http://www.OpenLDAP.org/doc/admin/)

---

💜 ACKNOWLEDGEMENTS 💜

This manual page has been written by Peter Marschall, based on the module's README file written by Howard Chu. give them their flowers. 💐

OpenLDAP is developed and maintained by The OpenLDAP Project (http://www.openldap.org/). OpenLDAP is derived from University of Michigan LDAP 3.3 Release.

---

and that's the whole page, bestie — no details skipped, no options ghosted, we ate and left no crumbs. 🫶

signing off from OpenLDAP LDVERSION, dated RELEASEDATE, still serving you SLAPO-SMBK5PWD(5) realness. bye babe 💖✨🎀