Re: GSSAPI on sparc64 (ITS#3054)

[tiamat@komi.mts.ru]

Kurt D. Zeilenga wrote:

> From the information you provide, it is unclear whether the
>problem lies with OpenLDAP Software or with Cyrus SASL or
>at a lower level (GSSAPI/Kerberos).  You also did not say
>which version of Cyrus SASL nor which flavor/version of
>Kerberos you were using.  I suggest you try the latest
>Cyrus SASL libraries with the latest Heimdal Kerberos
>libraries.
>
I am sorry for the incomplete information.

I use Cyrus SASL 2.1.18 and Heimdal Kerberos 0.6 (as a part of the base system FreeBSD 5.2.1)

All kerberos application works fine (pam_krb5, telnet)
All applications which use CyrusSASL/GSSAPI for authentication also works fine (cyrus-imapd-2.2.3, sample client/server from Cyrus SASL 2.1.18):

# klist
Credentials cache: FILE:/tmp/krb5cc_0
        Principal: tiamat@KOMI.MTS.RU

  Issued           Expires          Principal
Apr  3 22:05:15  Apr  4 08:01:02  krbtgt/KOMI.MTS.RU@KOMI.MTS.RU
Apr  3 22:05:22  Apr  4 08:01:02  imap/selma.komi.mts.ru@KOMI.MTS.RU

# /usr/local/bin/imtest -u tiamat -a tiamat -m GSSAPI selma
S: * OK selma.komi.mts.ru Cyrus IMAP4 v2.2.3 server ready
C: C01 CAPABILITY
S: * CAPABILITY IMAP4 IMAP4rev1 ACL QUOTA LITERAL+ MAILBOX-REFERRALS NAMESPACE UIDPLUS ID NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY SORT THREAD=ORDEREDSUBJECT THREAD=REFERENCES ANNOTATEMORE IDLE AUTH=NTLM AUTH=GSSAPI AUTH=DIGEST-MD5 AUTH=CRAM-MD5 SASL-IR
S: C01 OK Completed
C: A01 AUTHENTICATE GSSAPI YIICJQYJKoZIhvcSAQICAQBuggIUMIICEKADAgEFoQMCAQ6iBwMFACAAAACjggEsYYIBKDCCASSgAwIBBaENGwtLT01JLk1UUy5SVaIkMCKgAwIBAaEbMBkbBGltYXAbEXNlbG1hLmtvbWkubXRzLnJ1o4HnMIHkoAMCARChAwIBAqKB1wSB1LPCl29hZ87YkK4Ajd5//cEVEjbgyQGoGLPo6daUxBu7/tVgJkqH+AX9CnG+aeGGF3fAbgr6uvKfVtKY0/WyVGisrqIxuhJNrhTcoEyuAUmpbiU0j8YCod8gRjgmnkZbXF4x9poXTQItX/Ai8oBmE0UwEcyPOamowVZ248Hn3Awt0XNXGwluBYKTx9p9ryrGMJrj2eBfyj4ryG7cTMTCohUxFF6BbluBmkLOmW1lBlGRf7dEyPvJh5LJcM7d3GnHlri74p6QyR2lWPKwmJjY2v0FespipIHKMIHHoAMCARCigb8EgbyQaaBL5J3skGlYWdhgNxV8pSO/EEMcC0JSx3k42tSIgE2xs2+m7Q1YdrHqQHCwzVHBtcuwz80u1V8rn2hfb2zIwAMLXTM+N/oczj8ml7A9aDi/At16TeJkOBcblir7GIqCgjEBzaIp7yxX4dqh6pFXpa0u8O/WvYLCaY5Dq3sbZ6z6FUxctAuQn+uEMprysJauhkimj5eC92lgcik8C74RPzeNwpZIegMLyHO7sFvkaNGJgq6LlfeX19NWzg==
S: + YGwGCSqGSIb3EgECAgIAb10wW6ADAgEFoQMCAQ+iTzBNoAMCARCiRgREQjFfRP7x3L7auXiiUmiEaclCiQT8f05zjUof1yTSqO79jgWlLq1m0BOuV0iGeK6F0VKWMCyHDnfUsE+Er0TZP0GkVNs=

S: + YD8GCSqGSIb3EgECAgIBBAD/////X3v/uxD6cDKwONlpLYD+fI7bsiBeWIMNHTpqG0oMDgzDzfhMBwAQAAQEBAQ=
C: YEcGCSqGSIb3EgECAgIBBAD/////ynzzOyzA8clP//1D0eMtc8ahBJXMlOrHxeJzyJUkoONzjFDsBAAEAHRpYW1hdAYGBgYGBg==
S: A01 OK Success (privacy protection)
Authenticated.
Security strength factor: 56

Only OpenLDAP does not work with GSSAPI in our environment.

Thanks a lot!