Merge the Kerberos and LDAP authentication backends
- Dominant language
- Go
- Stars
- 36.3k
- Forks
- 4.8k
- PR merge metrics
- PR metrics pending
Description
**Is your feature request related to a problem? Please describe.**
Looking at https://developer.hashicorp.com/vault/docs/auth/kerberos the Kerberos authentication backend is very similar to the regular LDAP backend. Maintaining two sets of rules that do more or less the same things are redundant and leaves the risk of possibly updating one set of rules but missing the other.
**Describe the solution you'd like**
I'd like the Kerberos authentication method to be merged into the LDAP authentication method such that a keytab can be used when authenticating with the LDAP backend. This could be configured for example under `auth/ldap/config/kerberos` separately from the regular ldap config.
**Describe alternatives you've considered**
Use terraform to mirror the LDAP and Kerberos configuration.
**Explain any additional use-cases**
This could reduce the maintenance burden having to maintain one less authentication method.
**Additional context**
N/A
Contributor guide
Research direction
Start by comparing the Kerberos authentication backend at the linked Vault documentation page with the regular LDAP authentication backend. Trace how their configuration and authentication behavior are represented in the repository, then determine the scope needed for LDAP to accept a keytab through a separate Kerberos configuration. Done means the two backends no longer require duplicated rules while both authentication modes remain supported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100