[28482] in Kerberos
Re: Forcing the use of kerberos by ldap clients when connecting to an
daemon@ATHENA.MIT.EDU (drjlove@gmail.com)
Mon Sep 24 18:00:17 2007
From: drjlove@gmail.com
Date: Mon, 24 Sep 2007 14:55:06 -0700
Message-ID: <1190670906.392057.66800@g4g2000hsf.googlegroups.com>
Mime-Version: 1.0
X-Complaints-To: groups-abuse@google.com
In-Reply-To: <1190647481.438291.282620@n39g2000hsh.googlegroups.com>
Complaints-To: groups-abuse@google.com
To: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Actually I'm a putz,
What I was trying to do would never have worked! authentication
against LDAP using GSSAPI requires the user to have already signed
into a kerberos realm and have a token. In my setup, that token was
not available (the user never signs in), hence it'd never work.
Giving user's passwords in ldap itself works until I organise the
kerberos login stuff.
Jamie
On Sep 25, 1:24 am, drjl...@gmail.com wrote:
> Hello all,
>
> I have an openldap server that successfully authenticates against a
> kerberos setup:
>
> [jamie@janeiro ~]$ ldapwhoami -Y GSSAPI
> SASL/GSSAPI authentication started
> SASL username: ja...@example.com
> SASL SSF: 56
> SASL installing layers
> dn:uid=jamie,ou=people,dc=example,dc=com
> Result: Success (0)
>
> When I do not put -Y GSSAPI in, I get:
>
> [jamie@janeiro ~]$ ldapwhoami
> ldap_sasl_interactive_bind_s: No such object (32)
>
> Is it possible to force the client or server to use GSSAPI for
> authentication, so I don't need to write it every time. In my
> slapd.conf file I have:
>
> TLSCertificateFile /etc/openldap/cacerts/newcert.pem
> TLSCertificateKeyFile /etc/openldap/cacerts/newreq.pem
> ...
> sasl-secprops noanonymous,noplain,noactive
> saslRegexp uid=([^/]*),cn=GSSAPI,cn=auth uid=
> $1,ou=people,dc=example,dc=com
>
> In particular this sasl-secprops is (according to the website I
> pilfered that line off) in theory will force the use of GSSAPI, but in
> practice it doesn't.
>
> The reason I wish to force GSSAPI is to make a java app I need to
> interoperate with use the right mechanism (i.e. GSSAPI), and hence
> authenticate against kerberos via LDAP rather than authenticate
> against ldap only.
>
> Thanks for any help.
> Jamie
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
