SECURE, CENTRALIZED AUTHENTICATION & SHARED SERVICES

with Kerberos, OpenLDAP & NFS

NETWORK USERS

Access resources securely
from Linux and Ubuntu
Workstations and Servers.

Ubuntu
Desktop

Linux
Desktop

Linux
Server

SSH / CLI
Access

Shared Files
(NFS)

USER BENEFITS FROM:

  • Single-Signon (SSO)
  • Secure Authentication
  • Centralized Accounts
  • Shared Files and Home Directories (NFS)
  • Consistent Access Across All Systems
SITE 1 (PRIMARY)

Main Server

Kerberos KDC
Authentication
(AS + TGS)

 ←

Openldap server
Central Directory
(accouns, groups. Policies)

 ↔

NFS Server
Shared Directories (Home, Projects, Data)

 ↔

Other Services
Web, Mail, DNS, Monitoring, etc.

 ↙
 

Kerberos
↓
 

LOCAL STORAGE

Local Data
Backups
Configs

SITE 2 (SECONDARY)

Backup / Remote Site

 

Kerberos
↓
 

LOCAL STORAGE

Local Data
Backups
Configs

→

Kerberos KDC
Authentication
(AS + TGS)
↔

Openldap server
Central Directory
(accouns, groups. Policies)
↔

NFS Server
Shared Directories (Home, Projects, Data)
↘

Other Services
Web, Mail, DNS, Monitoring, etc.

NFS SHARED STORAGE ACCESS

Users mount NFS shares from either site.
High availability and consistency for shared files


Home Directories
(/home via NFS)


Project Data
(/projects via NFS)


Shared Data
(/data via NFS)

HOW IT WORKS

User logs in
on Linux/Mac
client

  

Client obtains
Kerberos ticket
from KDC

  

User validated
against OpenLDAP
directory

  

Access granted
to NFS shares
and network services

  

Single Sign-On
access all
resources

KEY BENEFITS

  • Strong Authentication with Kerberos (no passwords over the network)
  • Centralized User & Group Management with OpenLDAP
  • High Availability with multi-site OpenLDAP replication
  • Shared Files Access via NFS from any location
  • Scalable, Secure and Built on Open Source Technologies
  • Ideal for Linux/Mac Environments

Kerberos
Network authentication
using tickets. Enables
SSO and secure access

OpenLDAP
Open source directory
service for users, groups
and policies

NFS
Network File System for
shared directories
across the network

Security
SSL/TLS for replication
and secure
communications

Services
Additional network
services supported
on the infratructure

CAN WE CONNECT OUR MACS?

Yes! macOS integrates seamlessly with our Kerberos + OpenLDAP
infrastructure for secure authentication, file sharing, and email.

ONE ID. ONE PASSWORD. EVERYWHERE.

Users sign in once with Kerberos and get secure access
to files. folders, and mail across all systems.

CONNECTED MAC

  • macOS (Ventura/Sonoma)
  • Kerberos-aware
  • Open Directory
  • APFS for file sharing
  • Kerberized Mail (IMAP/SMTP)

Mac users authenticate with Kerberos and are part of the
central directory — just like Linux users.

USERS & DEVICES

 

SITE A (PRIMARY)

Director Server
(OpenLDAP)

NFS Server
(Shared Data)

TWO-SITE DIRECTORY INFRASTRUCTURE

OpenLDAP synchronized between sites for high availability and redundancy


KERBEROS

Secure authentication for
users and service. Across the network

SITE B (SECONDARY)

Director Server
(OpenLDAP)

NFS Server
(Shared Data)

FILE SHARING WITH APFS

Macs connect to shared folders over SMB with Kerberos authentication.
  • APFS fully supported
  • Secure, permission-based access
  • Reliable and fast performance

KERBERIZED MAIL

Mac Mail, Outlook, and other clients use Kerberos-authenticated IMAP & SMTP
  • IMAP (993) with Kerberos
  • SMTP (S87) with Kerberos
  • Secure single sign-on experience

CENTRALIZED IDENTITY

All users and groups managed in OpenLDAP and available to all systems and services.
  • Consistent permissions everywhere
  • Easy onboarding & offboarding
  • Works across platforms

WHY IT WORKS GREAT FOR MACS

Kerberos Authentication
Single sign-on across Macs. Linux and other systems

APFS File Sharing
Native macOS support for MB with Kerberos for secure reliable access

Kerherized Mail
IMAP and SMTP with Kerberos keeps credentials secure

Centralized Users & Groups
Managed in OpenLDAP and available to all systems

Enterprise-Grade Security
Strong authentication, encrypted connections. centralized policies

MACOS INTEGRATION HIGHLIGHTS

Open Directory
Macs use Kerberos via Open Directory for authentication

Network Login
Users log in with their directory account once and get access to resources.

Keychain Support
Kerberos tickets are securely stored in macOS Keychain.

Roaming Friendly
Users stay connected securely, on or off the network.

BUILT ON OPEN STANDARDS. DESIGNED FOR RELIABILITY.


Kerberos
Strong, ticket-based
authentication

OpenLDAP
Central directory for users,
groups and policies

NFS / SMB
Secure file sharing across
Linux and macOS.

IMAP / SMTP
Kerberized email access
for all users..

Security First
Encrypted connections,
least-privilene access

KAjohansen Logo Logo Detail Logo Detail