10.9 Changes to PasswordServer External Command

Question

Has  anyone noticed any 10.9 changes in regards to passwordserver's external commands ?
On 10.8 servers, I have modified the LDAP cn=config,cn=passwordserver apple-xmlplist entry to have it launch /usr/bin/authserver/tools/myscript on each password change. This in turn computes a hash that I can use to sync passwords with Google.
On the 10.9 boxes, however, I've noticed that the apple-xmlplist entry was missing. I've tried re-creating it with the same content as on the 10.8 machines, and then restarting both passwordserver and opendirectory but I'm not seeing the script getting launched.
Anyone have a hint ?
- Jon

Answer 1

It seems that Apple changed from MIT Kerberos to Heimdal Kerberos.
That's why some features, like the external-commands, are not available anymore.
However the Heimdal Kerberos has a function called "external-check". This function allows you to specify an external program which checks whether the password meets the password-requirements (see: http://www.h5l.org/manual/HEAD/info/heimdal/Password-changing.html#Password-chan ging).
It seems that this features is also implemented in the OSX Server (see: https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/ man5/krb5.conf.5.html).
I think it should be possible to define this option and use an external script to get the password in cleartext.