[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Not able to get GSSAPI in supportedSASLMechanisms list

Padmavathi Dt wrote:
Hii List,

I am trying to get LDAP with SASL-GSSAPI mechanism.
In /usr/lib/sasl2,it has

[root@as3 sasl2]# ls libgssapi*
libgssapiv2.la  libgssapiv2.so  libgssapiv2.so.2  libgssapiv2.so.2.0.19

To verify the cyrus sasl mechanism is installed correctly, see the command 'pluginviewer'. For example:

neo:~# pluginviewer -s | grep -i GSSAPI
pluginviewer: SASL Other: OTP: auxprop backend can't store properties
Plugin "gssapiv2" [loaded],     API version: 4
        SASL mechanism: GSSAPI, best SSF: 56, supports setpass: no

I also have a working kerberos .I am able to get tickets from kerberos.I have added ldap host principal to kerberos database.

I have my slapd.conf as: (sasl related part)

sasl-host as3 sasl-realm BSNL.COM
authz-regexp uid=([^,]*),cn=bsnl.com,cn=gssapi,cn=auth

I don't believe any of these commands should be necessary for the GSSAPI mechanism to show up in the ldapsearch below.

(Also,I have added the first two lines after seing some mailing list.In the admin guide nothing was mentioned about adding the two lines.Please tell me whether it is correct?)

According to HOWTO doc from www.bayour.com,when we query ldap for supportedSASLMechanisms,it should show GSSAPI(my whole purpose).But
when I give the following:

[root@as3 openldap]# /usr/bin/ldapsearch -H "ldaps://:12345" -x -b "" -s base -LLL supportedSASLMechanisms
supportedSASLMechanisms: NTLM
supportedSASLMechanisms: PLAIN
supportedSASLMechanisms: LOGIN

Does it mean that LDAP was not built with SASL support?

This could mean that openldap is not able to find a keytab containing the proper kerberos principal, or some other problem which prevents it initialing GSSAPI.

I have slapd.conf in /usr/lib/sasl2 as: pwcheck_method: /usr/sbin/saslauthd saslauthd_path: /var/run/saslauthd/mux mech_list: plain login ntlm kerberos5

kerberos5 doesn't look right. It should be 'gssapi'. My /usr/lib/sasl2/slapd.conf happens to look like:

keytab: /etc/krb5.keytab-ldap
pwcheck_method: auxprop saslauthd
auxprop_plugin: slapd

Specifying mech_list isn't necessary.

- Dan