Hello Quanah,

Thank you very much for your email. It worked for me (I passed GSSAPI as the string), dn as NULL and I could now see in the packet capture that an sasl bind request is being sent out using GSSAPI. Below is the snapshot.

Lightweight Directory Access Protocol

LDAPMessage bindRequest(1) "<ROOT>" sasl

messageID: 1

protocolOp: bindRequest (0)

bindRequest

version: 3

name:

authentication: sasl (3)

sasl

mechanism: GSSAPI

credentials: 6d797077

GSS-API Generic Security Service Application Program Interface

Unknown header (class=1, pc=1, tag=13) <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< Why unknown ?

[Expert Info (Warn/Protocol): Unknown header (class=1, pc=1, tag=13)]

[Unknown header (class=1, pc=1, tag=13)]

[Severity level: Warn]

[Group: Protocol]

I was getting something like this above where there is a part of the packet shown as unknown header. I am suspecting that wireshark is not recognizing this or this is again a different problem. Look forward to your feedback.

regards,

Nishanth

On Mon, Jul 10, 2017 at 11:23 PM, Quanah Gibson-Mount <quanah@symas.com> wrote:

--On Monday, July 10, 2017 9:02 PM +0530 Nishanth Nagendra <nishanth.amogh@gmail.com> wrote:

>From the openldap source code, I notice that sasl.c file has a constant
LDAP_SASL_SIMPLE as a constant for mechanism which is a NULL value. I
tried to pass a non NULL value in my function call to ldap_sasl_bind in
the third parameter expecting it to hit the other code path to initiate
SASL bind with credentials but the library does not seem to allow it and
returns error from sasl bind.

As clearly noted in the source code comments, the third argument is the MECHANISM to use:

/*
* ldap_sasl_bind - bind to the ldap server (and X.500).
* The dn (usually NULL), mechanism, and credentials are provided.
* The message id of the request initiated is provided upon successful
* (LDAP_SUCCESS) return.
*
* Example:
* ldap_sasl_bind( ld, NULL, "mechanism",
* cred, NULL, NULL, &msgid )
*/

I.e., you would pass in "GSSAPI" for a SASl/GSSAPI bind, etc.

It is also generally better form to use ldap_sasl_interactive_bind_s, as noted in the man page. In that case, as noted by the manual page:

The mechs parameter should contain
a space-separated list of candidate mechanisms to use. If this
parameter is NULL or empty the library will query the
supportedSASLMechanisms attribute from the server's rootDSE for the
list of SASL mechanisms the server supports.

--Quanah

--

Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>