[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: external authentication source

On 12. mars 2015 13:03, Dieter Klünter wrote:
rfc-4422 describes an EXTERNAL mechanism. Is there any means of
defining and configuring an external authentication and authorization
source, like an external sasl server? Or is this just confined to the
client to provide an appropriate authorization string?

EXTERNAL means the credentials are passed in another layer than SASL (or
LDAP): A TLS client certificate, or with ldapi:// (Unix domain sockets)
some OSes including Linux can get the user/group ID from the socket.
Try "ldapwhoami -H ldapi://".

What you describe sounds to me more like stuff like Kerberos tickets.
These are passed inside a SASL mechanism (GSSAPI), after SASL on
the server side is configured to check them against a Kerberos server.