When configuring MIT Kerberos to use an LDAP database instead of DB2, I was surprised to see that user password hashes are stored in two different fields: userPassword and krbPrincipalKey. Seems the hashing algorithms may be different, but that seems unnecessary too. Why not just consolidate to avoid synchronization issues?
SnapOverflow
OpenLDAP cannot directly handle
krbPrincipalKeydata for authentication. I am not entirely familiar with how FreeIPA handles handles passwords, but for other OpenLDAP/Kerberos installations, OpenLDAP is often instructed to use SASL passthrough authentication.