diff -ru openssh-3.7.1p1/auth-rsa.c openssh-3.7.1p1-ldappubkey/auth-rsa.c
--- openssh-3.7.1p1/auth-rsa.c	Wed May 14 05:40:07 2003
+++ openssh-3.7.1p1-ldappubkey/auth-rsa.c	Tue Sep 23 11:31:09 2003
@@ -150,6 +150,7 @@
  * return key if login is allowed, NULL otherwise
  */
 
+/* LDAP HOOK FOR RSA1 KEYS */
 int
 auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
 {
@@ -160,10 +161,104 @@
 	u_long linenum = 0;
 	struct stat st;
 	Key *key;
+#ifdef WITH_LDAP_PUBKEY
+	lh_t host;
+	pkdata **data = NULL;
+	int i = 0;
+#endif
 
 	/* Temporarily use the user's uid. */
 	temporarily_use_uid(pw);
 
+#ifdef WITH_LDAP_PUBKEY
+
+	/* JUST HERE  HACK HACK */
+	key = key_new(KEY_RSA1);
+
+	debug("[LDAP] trying to get RSA1 key");
+
+	/* lets get the identity.pub from the ldap server */
+	/* i must fill Key *key with the read key struct */
+	host.lpkuurl = options.lpk_opt.lpk_user_server;
+	host.lpkgurl = options.lpk_opt.lpk_group_server;
+	host.lpkbd = options.lpk_opt.lpk_binddn;
+	host.lpkbp = options.lpk_opt.lpk_bindpw;
+	host.lpksg = options.lpk_opt.lpk_srvgrp;
+
+	/* if(options.myldap_opt.pubkey_from_ldap && key_ldap_read(key, pw->pw_name, &host) != 1) { */
+	if(options.lpk_opt.lpk_on && (data = get_ldap_data(&host, pw)) ) {
+	    debug("LDAP pubkey failed!!\n");
+	    debug("User URL: %s !!", options.lpk_opt.lpk_user_server);
+	} 
+	
+	if (data)
+	    while(data[i] != NULL) {
+		char *cp, *options;
+
+		for (cp = (char *)data[i++]->bv_val; *cp == ' ' || *cp == '\t'; cp++)
+			;
+		if (!*cp || *cp == '\n' || *cp == '#')
+			continue;
+
+		/*
+		 * Check if there are options for this key, and if so,
+		 * save their starting address and skip the option part
+		 * for now.  If there are no options, set the starting
+		 * address to NULL.
+		 */
+		if (*cp < '0' || *cp > '9') {
+			int quoted = 0;
+			options = cp;
+			for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
+				if (*cp == '\\' && cp[1] == '"')
+					cp++;	/* Skip both */
+				else if (*cp == '"')
+					quoted = !quoted;
+			}
+		} else
+			options = NULL;
+
+		/* Parse the key from the line. */
+		if (hostfile_read_key(&cp, &bits, key) == 0) {
+			debug("[LDAP] line %d: non ssh1 key syntax", i);
+			continue;
+		}
+		/* cp now points to the comment part. */
+
+		/* Check if the we have found the desired key (identified by its modulus). */
+		if (BN_cmp(key->rsa->n, client_n) != 0)
+			continue;
+
+		/* check the real bits  */
+		if (bits != BN_num_bits(key->rsa->n))
+			logit("[LDAP] Warning: ldap, line %lu: keysize mismatch: "
+				"actual %d vs. announced %d.", (unsigned long)i, BN_num_bits(key->rsa->n), bits);
+
+		/* We have found the desired key. */
+		/*
+		 * If our options do not allow this key to be used,
+		 * do not send challenge.
+		 */
+		if (!auth_parse_options(pw, options, "[LDAP]", (unsigned long) i))
+			continue;
+
+		/* break out, this key is allowed */
+		allowed = 1;
+
+		/* add the return stuff etc... */
+		/* Restore the privileged uid. */
+		restore_uid();
+
+		/* return key if allowed */
+		if (allowed && rkey != NULL)
+		    *rkey = key;
+		else
+		    key_free(key);
+		
+		ldap_value_free_len(data);
+		return (allowed);
+	    }
+#endif
 	/* The authorized keys. */
 	file = authorized_keys_file(pw);
 	debug("trying public RSA key file %s", file);
diff -ru openssh-3.7.1p1/auth2-pubkey.c openssh-3.7.1p1-ldappubkey/auth2-pubkey.c
--- openssh-3.7.1p1/auth2-pubkey.c	Sat Jun 28 04:38:02 2003
+++ openssh-3.7.1p1-ldappubkey/auth2-pubkey.c	Tue Sep 23 10:56:11 2003
@@ -174,12 +174,88 @@
 	struct stat st;
 	Key *found;
 	char *fp;
+#ifdef WITH_LDAP_PUBKEY
+	int i = 0;
+	lh_t host;
+	pkdata **data = NULL;
+#endif
 
 	if (pw == NULL)
 		return 0;
 
 	/* Temporarily use the user's uid. */
 	temporarily_use_uid(pw);
+#ifdef WITH_LDAP_PUBKEY
+	found_key = 0;
+	/* allocate a new key type */
+	found = key_new(key->type);
+
+	/* first check if the options is enabled, then try.. */
+	debug("trying LDAP first uid=%s",pw->pw_name);
+	
+	/* lets add it */
+	host.lpkuurl = options.lpk_opt.lpk_user_server;
+	host.lpkgurl = options.lpk_opt.lpk_group_server;
+	host.lpkbd = options.lpk_opt.lpk_binddn;
+	host.lpkbp = options.lpk_opt.lpk_bindpw;
+	host.lpksg = options.lpk_opt.lpk_srvgrp;
+
+	/* lets fill what we request */
+
+	if(options.lpk_opt.lpk_on && ( data = get_ldap_data(&host,pw) ) ) {
+	    debug2("[LDAP] get_ldap_data() pubkey failed!!!");
+	    debug2("URL: %s !!",options.lpk_opt.lpk_user_server);
+	}
+
+	if (data)
+	    while (data[i] != NULL) {
+		char *cp, *options = NULL;
+		/* Skip leading whitespace, empty and comment lines. */
+		for (cp = (char *)data[i++]->bv_val; *cp == ' ' || *cp == '\t'; cp++)
+		    ;
+		if (!*cp || *cp == '\n' || *cp == '#')
+		    continue;
+
+		if (key_read(found, &cp) != 1) {
+		    /* no key?  check if there are options for this key */
+		    int quoted = 0;
+		    debug2("[LDAP] user_key_allowed: check options: '%s'", cp);
+		    options = cp;
+		    for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
+			if (*cp == '\\' && cp[1] == '"')
+			    cp++;	/* Skip both */
+			else if (*cp == '"')
+			    quoted = !quoted;
+		    }
+		    /* Skip remaining whitespace. */
+		    for (; *cp == ' ' || *cp == '\t'; cp++)
+			;
+		    if (key_read(found, &cp) != 1) {
+			debug2("[LDAP] user_key_allowed: advance: '%s'", cp);
+			/* still no key?  advance to next line*/
+			continue;
+		    }
+		}
+
+		if (key_equal(found, key) &&
+			auth_parse_options(pw, options, file, linenum) == 1) {
+		    found_key = 1;
+		    debug("[LDAP] matching key found");
+		    fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
+		    verbose("[LDAP] Found matching %s key: %s",
+			    key_type(found), fp);
+
+		    /* restoring memory */
+		    ldap_value_free_len(data);
+		    xfree(fp);
+		    restore_uid();
+		    key_free(found);
+		    return found_key;
+		    break;
+		}
+	    }
+
+#endif
 
 	debug("trying public key file %s", file);
 
diff -ru openssh-3.7.1p1/key.c openssh-3.7.1p1-ldappubkey/key.c
--- openssh-3.7.1p1/key.c	Mon Jul 14 09:28:34 2003
+++ openssh-3.7.1p1-ldappubkey/key.c	Tue Sep 23 10:56:11 2003
@@ -36,6 +36,32 @@
 
 #include <openssl/evp.h>
 
+#ifdef WITH_LDAP_PUBKEY
+/*
+ * defined in core.schema, this is a temporary objectclass which can be
+ * used since i m waiting for pkix schema and pubKey attribute (binary as well
+ * so minor changes for this patch), there will be an update about this ;)
+ * the following defs were for test purposes only
+ * i'm still keeping objectclass=strongAuthenticationuser because of the purpose
+ * this patch, and wrongly using cn for each user to store group includes
+ * refere to the README for a better understanding of this.
+ */
+
+#include <ldap.h>
+#include <lber.h>
+
+#define PORT LDAP_PORT
+#define LINEMAX 1024
+
+/* just filter building stuff */
+#define REQUEST_GROUP(buffer,pwname,grp) \
+snprintf(buffer,LINEMAX,"(&(objectclass=posixGroup)(cn=%s)(memberUid=%s))",grp,pwname)
+
+#define REQUEST_USER(buffer,pwname) \
+snprintf(buffer,LINEMAX,"(&(objectclass=posixAccount)(objectclass=strongAuthenticationUser)(uid=%s))",pwname);
+
+#endif
+
 #include "xmalloc.h"
 #include "key.h"
 #include "rsa.h"
@@ -374,6 +400,187 @@
 	OPENSSL_free(buf);
 	return 1;
 }
+
+#ifdef WITH_LDAP_PUBKEY
+
+/* get data needed for certificate and group management */
+pkdata ** get_ldap_data(lh_t *host, struct passwd *pw) {
+    LDAP *ld;
+    LDAPMessage *res, *e;
+    LDAPURLDesc *usr_urlstruct, *grp_urlstruct;
+    BerElement *ptr;
+    struct berval **vals;
+    int version, rc, ssl_size, i;
+    char *a,*urlssl,objbuf[LINEMAX];
+
+    /* version to 3 */
+    version = LDAP_VERSION3;
+
+    debug2("[LDAP] get_ldap_data()");
+
+    /* url based ldap://hostport/dn[?attrs[?scope[?filter[?exts]]]] */
+    rc = ldap_is_ldap_url(host->lpkuurl);
+    if (rc < 0) {
+	error("get_ldap_data: ldap_is_ldap_url(UserUrl) -> ldap is not a url");
+	return NULL;
+    }
+    /* parse the User URL format */
+    rc = ldap_url_parse(host->lpkuurl,&usr_urlstruct);
+    if (rc) {
+	error("get_ldap_data: ldap_url_parse(UserUrl) -> ldap couldn't be parsed");
+	return NULL;
+    }
+
+    debug3("[LDAP] ldap url parsed");
+    /* just get the size */
+    ssl_size = strlen(usr_urlstruct->lud_scheme)+strlen(usr_urlstruct->lud_host)+10;
+
+    /* memory allocation */
+    urlssl = (char *) malloc ( ssl_size * sizeof(char) );
+    if (!urlssl) {
+	error("get_ldap_data: malloc()");
+	/* free what has been allocated */
+	ldap_free_urldesc(usr_urlstruct);
+	return NULL;
+    }
+
+    /* clearing the chunk */
+    memset(urlssl,0,ssl_size);
+    /* lets format */
+    snprintf(urlssl,ssl_size,"%s://%s:%d",usr_urlstruct->lud_scheme,usr_urlstruct->lud_host,usr_urlstruct->lud_port);
+
+    /* open ldap connection */
+    ld = ldap_init(usr_urlstruct->lud_host,usr_urlstruct->lud_port);
+    if(!ld) {
+	error("get_ldap_data: ldap_init()");
+	/* free what has been allocated */
+	free(urlssl);
+	ldap_free_urldesc(usr_urlstruct);
+	return NULL;
+    }
+
+    /* setting V3 proto otherwise TLS impossible */
+    if (ldap_set_option(ld,LDAP_OPT_PROTOCOL_VERSION,&version) != LDAP_OPT_SUCCESS) {
+	error("get_ldap_data: ldap couldn't set version for TLS/SSL");
+	/* free what has been allocated */
+	free(urlssl);
+	ldap_free_urldesc(usr_urlstruct);
+	return NULL;
+    }
+
+    /* HERE CHOOSE SSL/TLS use the scheme, look for the magic 's' ;) */
+    if (usr_urlstruct->lud_scheme[strlen(usr_urlstruct->lud_scheme)-1] == 's') {
+	if (ldap_initialize(&ld, urlssl) != LDAP_SUCCESS) {
+	    error("get_ldap_data: ldap_initialize()");
+
+	    /* free what has been allocated */
+	    free(urlssl);
+	    ldap_free_urldesc(usr_urlstruct);
+	    return NULL;
+	}
+    } else {
+	if ( ldap_start_tls_s( ld, NULL, NULL ) != LDAP_SUCCESS) {
+	    ldap_perror( ld, "get_ldap_data: (TLS) ldap_start_tls" );
+	    /* recover to normal connection */
+	    ld = ldap_init(usr_urlstruct->lud_host,usr_urlstruct->lud_port);
+	    if(!ld) {
+		error("get_ldap_data: ldap_init()");
+		
+		/* free what has been allocated */
+		free(urlssl);
+		ldap_free_urldesc(usr_urlstruct);
+		return NULL;
+	    }
+	    /* 	use_ssl=1; */
+	}
+    }
+
+    /* anonymous bind pubkey can be retrieved by anybody */
+    if (ldap_simple_bind_s(ld,host->lpkbd,host->lpkbp) != LDAP_SUCCESS) {
+	error("get_ldap_data: ldap_simple_bind_s()");
+	
+	/* free what has been allocated */
+	free(urlssl);
+	ldap_free_urldesc(usr_urlstruct);
+	return NULL;
+    }
+
+    /* New filter group inclusive depend on the configuration */
+    /* (&(objectclass=posixGroup)(&(cn=unix)(memberUid=eau))) */
+    debug("[LDAP] group y/n?");
+    if (host->lpksg && host->lpkgurl) {
+	debug2("[LDAP-group] '%s' part of group '%s'",pw->pw_name ,host->lpksg);
+
+	/* url based ldap://hostport/dn[?attrs[?scope[?filter[?exts]]]] */
+	rc = ldap_is_ldap_url(host->lpkgurl);
+	if (rc < 0) {
+	    error("get_ldap_data: ldap_is_ldap_url(GroupUrl) -> ldap is not a url");
+	    free(urlssl);
+	    ldap_free_urldesc(usr_urlstruct);
+	    return NULL;
+	}
+	/* parse the Group URL format */
+	rc = ldap_url_parse(host->lpkgurl,&grp_urlstruct);
+	if (rc) {
+	    error("get_ldap_data: ldap_url_parse(GroupUrl) -> ldap couldn't be parsed");
+	    free(urlssl);
+	    ldap_free_urldesc(usr_urlstruct);
+	    return NULL;
+	}
+	/*snprintf(objbuf,LINEMAX,"(&(objectclass=posixGroup)(cn=%s)(memberUid=%s))",request->pk_group,request->pk_pw->pw_name);*/
+
+	REQUEST_GROUP(objbuf,pw->pw_name,host->lpksg);
+
+	ldap_search_s(ld,grp_urlstruct->lud_dn,LDAP_SCOPE_SUBTREE,objbuf,NULL,0,&res);
+	i = ldap_count_entries(ld,res);
+	debug2("[LDAP-group] results: %d",i);
+	if (i <= 0) {
+	    debug2("[LDAP-group] uid: %s not in '%s'",pw->pw_name, host->lpksg);
+	    error("get_ldap_data: '%s' is not in '%s'", pw->pw_name, host->lpksg);
+	    free(urlssl);
+	    ldap_free_urldesc(usr_urlstruct);
+	    ldap_free_urldesc(grp_urlstruct);
+	    return NULL;
+	}
+	ldap_free_urldesc(grp_urlstruct);
+    }
+
+    /* cleaning memory slots */
+    memset(objbuf,0,LINEMAX);
+
+    /* user request */
+    /* (&(objectclass=posixAccount)(objectclass=strongAuthenticationUser)(&(cn=*groupname*)(uid=eau))) */
+    /* snprintf(objbuf,LINEMAX,"(&(objectclass=posixAccount)(objectclass=strongAuthenticationUser)(uid=%s))",request->pk_pw->pw_name);
+     * */
+
+    debug2("[LDAP] searching '%s''s keys", pw->pw_name);
+    REQUEST_USER(objbuf,pw->pw_name);
+
+    ldap_search_s(ld,usr_urlstruct->lud_dn,LDAP_SCOPE_SUBTREE,objbuf,NULL,0,&res);
+    i = ldap_count_entries(ld,res);
+
+    if (i > 0)
+	for(e=ldap_first_entry(ld,res); e != NULL; e=ldap_next_entry(ld,e)) {
+	    ldap_get_dn(ld,e);
+	    for(a=ldap_first_attribute(ld,e,&ptr);a!=NULL;a=ldap_next_attribute(ld,e,ptr)) {
+		if(strncmp(a,"userCertificate",15) == 0) {
+		    debug2("[LDAP] found some keys returning");
+		    vals=ldap_get_values_len(ld,e,a);
+		    free(urlssl);
+		    ldap_free_urldesc(usr_urlstruct);
+		    ldap_unbind_s(ld);
+		    return vals;
+		} /* end of if(strncmp) */
+	    } /* end of for */
+	} /* end of for */
+
+    free(urlssl);
+    ldap_free_urldesc(usr_urlstruct);
+    ldap_unbind_s(ld);
+
+    return NULL;
+}
+#endif
 
 /* returns 1 ok, -1 error */
 int
diff -ru openssh-3.7.1p1/key.h openssh-3.7.1p1-ldappubkey/key.h
--- openssh-3.7.1p1/key.h	Sat Jun 28 04:38:02 2003
+++ openssh-3.7.1p1-ldappubkey/key.h	Tue Sep 23 10:56:11 2003
@@ -28,6 +28,10 @@
 
 #include <openssl/rsa.h>
 #include <openssl/dsa.h>
+#ifdef WITH_LDAP_PUBKEY
+#include <ldap.h>
+#include <lber.h>
+#endif
 
 typedef struct Key Key;
 enum types {
@@ -65,6 +69,26 @@
 char	*key_type(Key *);
 int	 key_write(Key *, FILE *);
 int	 key_read(Key *, char **);
+#ifdef WITH_LDAP_PUBKEY
+
+#define KEY_ATTR "userCertificate"
+#define GRP_ATTR "notknownyet"
+
+/* just nicer to look at */
+typedef struct berval pkdata;
+
+/* next step is to handle fallback on ldap servers */
+typedef struct ldaphost {
+    char *lpkuurl;		   /* LDAP users infos in URL format */
+    char *lpkgurl;		   /* LDAP groups infos in URL format */
+    char *lpkbd;	   /* bind DN */
+    char *lpkbp;	   /* bind PW :> */
+    char *lpksg;	   /* server group name */
+    struct ldaphost *next;
+} lh_t;
+
+pkdata **get_ldap_data(lh_t *, struct passwd *);
+#endif
 u_int	 key_size(Key *);
 
 Key	*key_generate(int, u_int);
diff -ru openssh-3.7.1p1/servconf.c openssh-3.7.1p1-ldappubkey/servconf.c
--- openssh-3.7.1p1/servconf.c	Tue Sep  2 14:58:22 2003
+++ openssh-3.7.1p1-ldappubkey/servconf.c	Tue Sep 23 10:56:11 2003
@@ -100,6 +100,15 @@
 	options->client_alive_count_max = -1;
 	options->authorized_keys_file = NULL;
 	options->authorized_keys_file2 = NULL;
+#ifdef WITH_LDAP_PUBKEY
+	options->lpk_opt.lpk_on = -1;
+	options->lpk_opt.lpk_user_server = NULL;
+	options->lpk_opt.lpk_group_server = NULL;
+	options->lpk_opt.lpk_binddn = NULL;
+	options->lpk_opt.lpk_bindpw = NULL;
+	options->lpk_opt.lpk_srvgrp = NULL;
+	options->lpk_opt.lpk_x509 = -1;
+#endif
 
 	/* Needs to be accessable in many places */
 	use_privsep = -1;
@@ -224,7 +233,22 @@
 	}
 	if (options->authorized_keys_file == NULL)
 		options->authorized_keys_file = _PATH_SSH_USER_PERMITTED_KEYS;
-
+#ifdef WITH_LDAP_PUBKEY
+	if (options->lpk_opt.lpk_on == -1)
+	    options->lpk_opt.lpk_on = _DEFAULT_LPK_ON;
+	if (options->lpk_opt.lpk_user_server == NULL)
+	    options->lpk_opt.lpk_user_server = _DEFAULT_LPK_USRURL;
+	if (options->lpk_opt.lpk_group_server == NULL)
+	    options->lpk_opt.lpk_group_server = _DEFAULT_LPK_GRPURL;
+	if (options->lpk_opt.lpk_binddn == NULL)
+	    options->lpk_opt.lpk_binddn = _DEFAULT_LPK_BINDDN;
+	if (options->lpk_opt.lpk_bindpw == NULL)
+	    options->lpk_opt.lpk_bindpw = _DEFAULT_LPK_BINDPW;
+	if (options->lpk_opt.lpk_srvgrp == NULL)
+	    options->lpk_opt.lpk_srvgrp = _DEFAULT_LPK_SGROUP;
+	if (options->lpk_opt.lpk_x509 == -1)
+	    options->lpk_opt.lpk_x509 = _DEFAULT_LPK_X509;
+#endif
 	/* Turn privilege separation on by default */
 	if (use_privsep == -1)
 		use_privsep = 1;
@@ -265,6 +289,9 @@
 	sGssAuthentication, sGssCleanupCreds,
 	sUsePrivilegeSeparation,
 	sDeprecated, sUnsupported
+#ifdef WITH_LDAP_PUBKEY
+        ,sPubkey_from_ldap, sLdap_userver, sLdap_gserver, sBinddn, sBindpw, sMgroup
+#endif
 } ServerOpCodes;
 
 /* Textual representation of the tokens. */
@@ -354,6 +381,27 @@
 	{ "clientalivecountmax", sClientAliveCountMax },
 	{ "authorizedkeysfile", sAuthorizedKeysFile },
 	{ "authorizedkeysfile2", sAuthorizedKeysFile2 },
+#ifdef WITH_LDAP_PUBKEY
+	/* old tokens */
+	/*
+	{ "pubkeyfromldap", sPubkey_from_ldap },
+	{ "ldapserver", sLdap_server },
+	{ "binddn", sBinddn },
+	{ "bindpw", sBindpw },
+	{ "mygroup", sMgroup },
+	*/
+
+	/* new one */
+	{ "lpkOn", sPubkey_from_ldap },
+	{ "lpkUserUrl", sLdap_userver },
+	{ "lpkGroupUrl", sLdap_gserver },
+	{ "lpkBindDn", sBinddn },
+	{ "lpkBindPw", sBindpw },
+	{ "lpkServerGroup", sMgroup },
+	/* later use
+	{ "lpkUseX509", sUseX509 },
+	*/
+#endif
 	{ "useprivilegeseparation", sUsePrivilegeSeparation},
 	{ NULL, sBadOption }
 };
@@ -890,6 +938,65 @@
 		while (arg)
 		    arg = strdelim(&cp);
 		break;
+#ifdef WITH_LDAP_PUBKEY
+	case sPubkey_from_ldap:
+		intptr = &options->lpk_opt.lpk_on;
+		goto parse_flag;
+	case sLdap_userver:
+		/* arg = strdelim(&cp); */
+		p = line;
+		while(*p++);
+		arg = p;
+		if (!arg || *arg == '\0')
+		    fatal("%s line %d: missing ldap server",filename,linenum);
+		arg[strlen(arg)-1] = '\0';
+		options->lpk_opt.lpk_user_server=xstrdup(arg);
+		memset(arg,0,strlen(arg));
+		break;
+	case sLdap_gserver:
+		/* arg = strdelim(&cp); */
+		p = line;
+		while(*p++);
+		arg = p;
+		if (!arg || *arg == '\0')
+		    fatal("%s line %d: missing ldap server",filename,linenum);
+		arg[strlen(arg)-1] = '\0';
+		options->lpk_opt.lpk_group_server=xstrdup(arg);
+		memset(arg,0,strlen(arg));
+		break;
+	case sBinddn:
+		/* arg = strdelim(&cp); */
+		p = line;
+		while(*p++);
+		arg = p;
+		if (!arg || *arg == '\0')
+		    fatal("%s line %d: missing binddn",filename,linenum);
+		arg[strlen(arg)-1] = '\0';
+		options->lpk_opt.lpk_binddn = xstrdup(arg);
+		memset(arg,0,strlen(arg));
+		break;
+	case sBindpw:
+		/* arg = strdelim(&cp); */
+		p = line;
+		while(*p++);
+		arg = p;
+		if (!arg || *arg == '\0')
+		    fatal("%s line %d: missing bindpw",filename,linenum);
+		arg[strlen(arg)-1] = '\0';
+		options->lpk_opt.lpk_bindpw=xstrdup(arg);
+		memset(arg,0,strlen(arg));
+		break;
+	case sMgroup:
+		p = line;
+		while (*p++);
+		arg = p;
+		if (!arg || *arg == '\0')
+		    fatal("%s line %d: missing groupname",filename, linenum);
+		arg[strlen(arg) - 1] = '\0';
+		options->lpk_opt.lpk_srvgrp = xstrdup(arg);
+		memset(arg,0,strlen(arg));
+		break;
+#endif
 
 	default:
 		fatal("%s line %d: Missing handler for opcode %s (%d)",
diff -ru openssh-3.7.1p1/servconf.h openssh-3.7.1p1-ldappubkey/servconf.h
--- openssh-3.7.1p1/servconf.h	Tue Sep  2 14:58:22 2003
+++ openssh-3.7.1p1-ldappubkey/servconf.h	Tue Sep 23 10:56:11 2003
@@ -32,6 +32,31 @@
 #define	PERMIT_NO_PASSWD	2
 #define	PERMIT_YES		3
 
+#ifdef WITH_LDAP_PUBKEY
+#define _DEFAULT_LDAP_PUBKEY_SERVER "localhost"
+#define _DEFAULT_BASEDN "ou=People,dc=company,dc=net"
+
+#define _DEFAULT_LPK_ON	   0
+#define _DEFAULT_LPK_X509  0
+#define _DEFAULT_LPK_USRURL "ldap://localhost/ou=users,dc=company,dc=net"
+#define _DEFAULT_LPK_GRPURL NULL
+#define _DEFAULT_LPK_BINDDN NULL
+#define _DEFAULT_LPK_BINDPW NULL
+#define _DEFAULT_LPK_SGROUP NULL
+
+/* later we will change lpk_on and lpk_x509 and other binary flags using a short
+ * flag register-like with AND/OR operations */
+typedef struct {
+    int lpk_on;		   /* enable Ldap PubKey */
+    char *lpk_user_server;	   /* ldap URL format where pubkeys are */
+    char *lpk_group_server;	   /* ldap URL format where pubkeys are */
+    char *lpk_binddn;	   /* ldap base dn where users resides */
+    char *lpk_bindpw;	   /* ldap bind passwd */
+    char *lpk_srvgrp;	   /* ldap server group name, NULL if deactivated */
+    int lpk_x509;
+} ldap_opt;
+#endif
+
 
 typedef struct {
 	u_int num_ports;
@@ -123,6 +148,9 @@
 	char   *authorized_keys_file;	/* File containing public keys */
 	char   *authorized_keys_file2;
 	int	use_pam;		/* Enable auth via PAM */
+#ifdef WITH_LDAP_PUBKEY
+        ldap_opt lpk_opt;
+#endif
 }       ServerOptions;
 
 void	 initialize_server_options(ServerOptions *);
diff -ru openssh-3.7.1p1/sshd_config openssh-3.7.1p1-ldappubkey/sshd_config
--- openssh-3.7.1p1/sshd_config	Tue Sep  2 14:51:18 2003
+++ openssh-3.7.1p1-ldappubkey/sshd_config	Tue Sep 23 11:28:20 2003
@@ -36,8 +36,8 @@
 #PermitRootLogin yes
 #StrictModes yes
 
-#RSAAuthentication yes
-#PubkeyAuthentication yes
+RSAAuthentication yes
+PubkeyAuthentication yes
 #AuthorizedKeysFile	.ssh/authorized_keys
 
 # For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
@@ -51,11 +51,11 @@
 #IgnoreRhosts yes
 
 # To disable tunneled clear text passwords, change to no here!
-#PasswordAuthentication yes
-#PermitEmptyPasswords no
+PasswordAuthentication yes
+PermitEmptyPasswords no
 
 # Change to no to disable s/key passwords
-#ChallengeResponseAuthentication yes
+ChallengeResponseAuthentication no
 
 # Kerberos options
 #KerberosAuthentication no
@@ -91,6 +91,16 @@
 
 # no default banner path
 #Banner /some/path
+ 
+# here is the new patched ldap related tokens
+# entries in your LDAP must be posixAccount & strongAuthenticationUser
+lpkOn yes
+lpkUserUrl ldap://127.0.0.1/ou=users,dc=cuckoos,dc=net
+lpkGroupUrl ldap://127.0.0.1/ou=groups,dc=cuckoos,dc=net
+#lpkBindDn cn=Manager,dc=cuckoos,dc=net
+#lpkBindPw secret
+lpkServerGroup unix
+#lpkUseX509 yes
 
 # override default of no subsystems
 Subsystem	sftp	/usr/libexec/sftp-server
diff -ru openssh-3.7.1p1/sshd_config.5 openssh-3.7.1p1-ldappubkey/sshd_config.5
--- openssh-3.7.1p1/sshd_config.5	Tue Sep  2 14:57:05 2003
+++ openssh-3.7.1p1-ldappubkey/sshd_config.5	Tue Sep 23 10:56:11 2003
@@ -699,6 +699,38 @@
 program.
 The default is
 .Pa /usr/X11R6/bin/xauth .
+.It Cm lpkOn
+Enable LDAP public key resolution. The argument must be
+.Dq yes
+or
+.Dq no .
+.It Cm lpkGroupUrl/lpkUserUrl
+Specifies LDAP User/Group in URL format. the following form may be used:
+.Pp
+.Bl -item -offset indent -compact
+.It
+.Cm lpkUserUrl
+.Sm off
+.Ar ldaps://127.0.0.1/ou=users,dc=cuckoos,dc=net
+.Sm on
+.It
+.Cm lpkGroupUrl
+.Sm off
+.Ar ldap://127.0.0.1/ou=groups,dc=cuckoos,dc=net
+.Sm on
+.El
+.Pp
+.It Cm lpkBindDn
+Specifies a LDAP bind DN to use when doing ldap lookups.
+.It Cm lpkBindPw
+Specifies a LDAP bind Password associated to the previous token.
+.It Cm lpkServerGroup
+Specifies the group is the host is part of.
+.It Cm lpkUseX509
+Enable X509 public key support The argument must be
+.Dq yes
+or
+.Dq no .
 .El
 .Ss Time Formats
 .Nm sshd
