[Date Prev][Date Next]
Re: Not able to get GSSAPI in supportedSASLMechanisms list
Padmavathi Dt wrote:
I am trying to get LDAP with SASL-GSSAPI mechanism.
In /usr/lib/sasl2,it has
[root@as3 sasl2]# ls libgssapi*
libgssapiv2.la libgssapiv2.so libgssapiv2.so.2 libgssapiv2.so.2.0.19
To verify the cyrus sasl mechanism is installed correctly, see
the command 'pluginviewer'. For example:
neo:~# pluginviewer -s | grep -i GSSAPI
pluginviewer: SASL Other: OTP: auxprop backend can't store properties
CRAM-MD5 PLAIN NTLM GSSAPI OTP DIGEST-MD5 ANONYMOUS LOGIN EXTERNAL
Plugin "gssapiv2" [loaded], API version: 4
SASL mechanism: GSSAPI, best SSF: 56, supports setpass: no
I also have a working kerberos .I am able to get tickets from kerberos.I
have added ldap host principal to kerberos database.
I have my slapd.conf as: (sasl related part)
I don't believe any of these commands should be necessary for the
GSSAPI mechanism to show up in the ldapsearch below.
(Also,I have added the first two lines after seing some mailing list.In
the admin guide nothing was mentioned about adding the two lines.Please
tell me whether it is correct?)
According to HOWTO doc from www.bayour.com,when we query ldap for
supportedSASLMechanisms,it should show GSSAPI(my whole purpose).But
when I give the following:
[root@as3 openldap]# /usr/bin/ldapsearch -H "ldaps://:12345" -x -b "" -s
base -LLL supportedSASLMechanisms
Does it mean that LDAP was not built with SASL support?
This could mean that openldap is not able to find a keytab
containing the proper kerberos principal, or some other problem
which prevents it initialing GSSAPI.
I have slapd.conf in /usr/lib/sasl2 as:
mech_list: plain login ntlm kerberos5
kerberos5 doesn't look right. It should be 'gssapi'. My
/usr/lib/sasl2/slapd.conf happens to look like:
pwcheck_method: auxprop saslauthd
Specifying mech_list isn't necessary.