To load the schema into LDAP, on the LDAP server install the krb5-kdc-ldap package. From a terminal enter:

sudo apt-get install krb5-kdc-ldap

Next, extract the kerberos.schema.gz file:

sudo gzip -d /usr/share/doc/krb5-kdc-ldap/kerberos.schema.gz
sudo cp /usr/share/doc/krb5-kdc-ldap/kerberos.schema /etc/ldap/schema/

The kerberos schema needs to be added to the cn=config tree. The procedure to add a new schema to slapd is also detailed in the section called “Configuration”.

First, install the necessary packages, from a terminal enter:

sudo apt-get install krb5-kdc krb5-admin-server krb5-kdc-ldap

Now edit /etc/krb5.conf adding the following options to under the appropriate sections:

[libdefaults]
        default_realm = EXAMPLE.COM

...

[realms]
        EXAMPLE.COM = {
                kdc = kdc01.example.com
                kdc = kdc02.example.com
                admin_server = kdc01.example.com
                admin_server = kdc02.example.com
                default_domain = example.com
                database_module = openldap_ldapconf
        }

...

[domain_realm]
        .example.com = EXAMPLE.COM


...

[dbdefaults]
        ldap_kerberos_container_dn = dc=example,dc=com

[dbmodules]
        openldap_ldapconf = {
                db_library = kldap
                ldap_kdc_dn = "cn=admin,dc=example,dc=com"

                # this object needs to have read rights on
                # the realm container, principal container and realm sub-trees
                ldap_kadmind_dn = "cn=admin,dc=example,dc=com"

                # this object needs to have read and write rights on
                # the realm container, principal container and realm sub-trees
                ldap_service_password_file = /etc/krb5kdc/service.keyfile
                ldap_servers = ldaps://ldap01.example.com ldaps://ldap02.example.com
                ldap_conns_per_server = 5
        }

	Change example.com, dc=example,dc=com, cn=admin,dc=example,dc=com, and ldap01.example.com to the appropriate domain, LDAP object, and LDAP server for your network.

Next, use the kdb5_ldap_util utility to create the realm:

sudo kdb5_ldap_util -D  cn=admin,dc=example,dc=com create -subtrees dc=example,dc=com -r EXAMPLE.COM -s -H ldap://ldap01.example.com

Create a stash of the password used to bind to the LDAP server. This password is used by the ldap_kdc_dn and ldap_kadmin_dn options in /etc/krb5.conf:

sudo kdb5_ldap_util -D  cn=admin,dc=example,dc=com stashsrvpw -f /etc/krb5kdc/service.keyfile cn=admin,dc=example,dc=com

Copy the CA certificate from the LDAP server:

scp ldap01:/etc/ssl/certs/cacert.pem .
sudo cp cacert.pem /etc/ssl/certs

And edit /etc/ldap/ldap.conf to use the certificate:

TLS_CACERT /etc/ssl/certs/cacert.pem

	The certificate will also need to be copied to the Secondary KDC, to allow the connection to the LDAP servers using LDAPS.

First, install the necessary packages. In a terminal enter:

sudo apt-get install krb5-kdc krb5-admin-server krb5-kdc-ldap

Next, edit /etc/krb5.conf to use the LDAP backend:

[libdefaults]
        default_realm = EXAMPLE.COM

...

[realms]
        EXAMPLE.COM = {
                kdc = kdc01.example.com
                kdc = kdc02.example.com
                admin_server = kdc01.example.com
                admin_server = kdc02.example.com
                default_domain = example.com
                database_module = openldap_ldapconf
        }

...

[domain_realm]
        .example.com = EXAMPLE.COM

...

[dbdefaults]
        ldap_kerberos_container_dn = dc=example,dc=com

[dbmodules]
        openldap_ldapconf = {
                db_library = kldap
                ldap_kdc_dn = "cn=admin,dc=example,dc=com"

                # this object needs to have read rights on
                # the realm container, principal container and realm sub-trees
                ldap_kadmind_dn = "cn=admin,dc=example,dc=com"

                # this object needs to have read and write rights on
                # the realm container, principal container and realm sub-trees
                ldap_service_password_file = /etc/krb5kdc/service.keyfile
                ldap_servers = ldaps://ldap01.example.com ldaps://ldap02.example.com
                ldap_conns_per_server = 5
        }

Create the stash for the LDAP bind password:

sudo kdb5_ldap_util -D  cn=admin,dc=example,dc=com stashsrvpw -f /etc/krb5kdc/service.keyfile cn=admin,dc=example,dc=com

Now, on the Primary KDC copy the /etc/krb5kdc/.k5.EXAMPLE.COM Master Key stash to the Secondary KDC. Be sure to copy the file over an encrypted connection such as scp, or on physical media.

sudo scp /etc/krb5kdc/.k5.EXAMPLE.COM [email protected]:~
sudo mv .k5.EXAMPLE.COM /etc/krb5kdc/

	Again, replace EXAMPLE.COM with your actual realm.

Finally, start the krb5-kdc daemon:

sudo /etc/init.d/krb5-kdc start

The Kerberos Admin Guide has some additional details.

For more information on kdb5_ldap_util see Section 5.6 and the kdb5_ldap_util man page.

Another useful link is the krb5.conf man page.