Re: Question on bind using Kerberos Service Ticket.

Thanks for the reply Howard, if i can further clarify what you mean is that given the ldap_sasl_bind fucntion prototype below :

ldap_sasl_bind(
LDAP   *ld,
LDAP_CONST char *dn,
LDAP_CONST char *mechanism,
struct berval *cred,
LDAPControl  **sctrls,
LDAPControl  **cctrls,
int    *msgidp )

i first call the Kerberos authentication functions to get the service ticket to the ldap server. Next i can simply use the above fuction specifying mechanism as "GSSAPI" and pointing cred to the Kerberos service ticket i just got ?

If this is right the ldap server will just verify the service ticket and send back the response for the fucntion to return success.

Is there anything else i need to take care of ?

On 11/26/07, Howard Chu <hyc@symas.com> wrote:

Austin Cherian wrote:
> Hi,
>    Im quite new to Openldap and am searching for answers to some
> questions on a particular case i have, i'd be glad if some one could
> help me out on this particular topic.
>
> I have a situation where i have to perform an LDAP bind to a given
> LDAP server with only being provided a service ticket to that
> particular LDAP server and nothing else, i have already explored the
> possibility of using SASL authentication method with GSSAPI as the
> mechanism, however i guess the GSSAPI mechanism takes user credentials
> as input and moves through the Kerberos protocol to finally provide
> the LDAP server with the service ticket.

Wrong. The GSSAPI mechanism does exactly what you're looking for.
--
  -- Howard Chu
  Chief Architect, Symas Corp.  http://www.symas.com
  Director, Highland Sun        http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP     http://www.openldap.org/project/