10.9 Changes to PasswordServer External Command

I also have this problem, and I'd like to update our opendirectory server to Mavericks. Any suggestions? Someone must have run into this? I've tried using Google's own "Google apps directory sync" but it requires LDAP to have a password attribute for it to work. Not optimal. Also with the externalcommand hook the password hash could be immediately pushed to Google. Apple has killed our ability to integrate with many enterprise systems by removing this funcitonality...

It seems that Apple changed from MIT Kerberos to Heimdal Kerberos.

That's why some features, like the external-commands, are not available anymore.

However the Heimdal Kerberos has a function called "external-check". This function allows you to specify an external program which checks whether the password meets the password-requirements (see: http://www.h5l.org/manual/HEAD/info/heimdal/Password-changing.html#Password-chan ging).

It seems that this features is also implemented in the OSX Server (see: https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/ man5/krb5.conf.5.html).

I think it should be possible to define this option and use an external script to get the password in cleartext.

Cedras,

Thanks for the suggestion. I will look into this.

I have the same problem running Server 4.0x.

@Cedras: have you found a solution? I tried to change krb5.conf (/etc/krb5.conf and/or /var/db/krb5kdc/kdc.conf) but it does not work.

Next i have entered some weak passwords using "weakpass_edit" but the PasswordServer seems to ignore this. So i think /usr/sbin/atuhserver/tools/weakpass is not used to check for weak passwords. How can this feature been (re)activated?

Any solution found on this? We are having the same issue.

Thanks