Hi,
I'm trying to get slapd to use heimdal kerberos to provide a single authentication backend for my network. I've followed the Administrator's Guide on SASL[1] and cyrus faq entry about connecting OpenLDAP with GSSAPI[2]. I'm stuck at the what I believe is a misunderstanding from my part.
I believe when I use -Y GSSAPI I should be using my braiam/admin credentials, but according to SASL facility in slapd I'm not providing any. strace confirms that it reads the /tmp/krb5cc_1000 file correctly.
I'm very confused as to how to proceed since most of the relevant results point to having not kinit'd.
I'm using Debian stable, slapd=2.4.47+dfsg-3+deb10u1, libsasl2-modules-gssapi-heimdal=2.1.27+dfsg-1+deb10u1.
debian@ldap01:~$ sudo ktutil -k /etc/krb5.keytab list /etc/krb5.keytab:
Vno Type Principal Aliases 4 aes256-cts-hmac-sha1-96 host/ldap01.example.com@EXAMPLE.COM 4 des3-cbc-sha1 host/ldap01.example.com@EXAMPLE.COM 4 arcfour-hmac-md5 host/ldap01.example.com@EXAMPLE.COM 9 aes256-cts-hmac-sha1-96 ldap/ldap01.example.com@EXAMPLE.COM 9 des3-cbc-sha1 ldap/ldap01.example.com@EXAMPLE.COM 9 arcfour-hmac-md5 ldap/ldap01.example.com@EXAMPLE.COM
debian@ldap01:~$ klist Credentials cache: FILE:/tmp/krb5cc_1000 Principal: braiam/admin@EXAMPLE.COM
Issued Expires Principal May 12 20:34:05 2020 May 13 20:34:05 2020 krbtgt/EXAMPLE.COM@EXAMPLE.COM May 12 20:34:11 2020 May 13 20:34:05 2020 ldap/ldap01.example.com@EXAMPLE.COM
debian@ldap01:~$ ldapsearch -LLL -Y GSSAPI -s "base" -b "" supportedSASLMechanisms -H $ldap_host SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) additional info: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown)
[1]: http://www.openldap.org/doc/admin24/sasl.html [2]: https://www.cyrusimap.org/sasl/sasl/faqs/openldap-sasl-gssapi.html
Hi,
On Thu, May 14, 2020 at 2:27 PM Braiam braiamp@gmail.com wrote:
I'm using Debian stable, slapd=2.4.47+dfsg-3+deb10u1, libsasl2-modules-gssapi-heimdal=2.1.27+dfsg-1+deb10u1.
debian@ldap01:~$ sudo ktutil -k /etc/krb5.keytab list /etc/krb5.keytab:
Can the slapd user read this keytab file?
On Thu, May 14, 2020 at 1:29 PM Andreas Hasenack andreas@canonical.com wrote:
Hi,
On Thu, May 14, 2020 at 2:27 PM Braiam braiamp@gmail.com wrote:
I'm using Debian stable, slapd=2.4.47+dfsg-3+deb10u1, libsasl2-modules-gssapi-heimdal=2.1.27+dfsg-1+deb10u1.
debian@ldap01:~$ sudo ktutil -k /etc/krb5.keytab list /etc/krb5.keytab:
Can the slapd user read this keytab file?
Yes, it can.
debian@ldap01:~$ getfacl /etc/krb5.keytab getfacl: Removing leading '/' from absolute path names # file: etc/krb5.keytab # owner: root # group: root user::rw- user:openldap:r-- group::--- mask::r-- other::---
Am Thu, 14 May 2020 13:22:28 -0400 schrieb Braiam braiamp@gmail.com:
Hi,
I'm trying to get slapd to use heimdal kerberos to provide a single authentication backend for my network. I've followed the Administrator's Guide on SASL[1] and cyrus faq entry about connecting OpenLDAP with GSSAPI[2]. I'm stuck at the what I believe is a misunderstanding from my part.
I believe when I use -Y GSSAPI I should be using my braiam/admin credentials, but according to SASL facility in slapd I'm not providing any. strace confirms that it reads the /tmp/krb5cc_1000 file correctly.
I'm very confused as to how to proceed since most of the relevant results point to having not kinit'd.
I'm using Debian stable, slapd=2.4.47+dfsg-3+deb10u1, libsasl2-modules-gssapi-heimdal=2.1.27+dfsg-1+deb10u1.
debian@ldap01:~$ sudo ktutil -k /etc/krb5.keytab list /etc/krb5.keytab:
Vno Type Principal Aliases 4 aes256-cts-hmac-sha1-96 host/ldap01.example.com@EXAMPLE.COM 4 des3-cbc-sha1 host/ldap01.example.com@EXAMPLE.COM 4 arcfour-hmac-md5 host/ldap01.example.com@EXAMPLE.COM 9 aes256-cts-hmac-sha1-96 ldap/ldap01.example.com@EXAMPLE.COM 9 des3-cbc-sha1 ldap/ldap01.example.com@EXAMPLE.COM 9 arcfour-hmac-md5 ldap/ldap01.example.com@EXAMPLE.COM
debian@ldap01:~$ klist Credentials cache: FILE:/tmp/krb5cc_1000 Principal: braiam/admin@EXAMPLE.COM
Issued Expires Principal May 12 20:34:05 2020 May 13 20:34:05 2020 krbtgt/EXAMPLE.COM@EXAMPLE.COM May 12 20:34:11 2020 May 13 20:34:05 2020 ldap/ldap01.example.com@EXAMPLE.COM
debian@ldap01:~$ ldapsearch -LLL -Y GSSAPI -s "base" -b "" supportedSASLMechanisms -H $ldap_host SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) additional info: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown)
Long time ago that I used a Heimdal KDC. AFAIR there are some minor differnces between sasl libgssapi, MIT-KRB5 libs and tools, and heimdal gss-api and kerberos tools. Please check the sasl2 configuration path for slapd.conf. https://www.cyrusimap.org/sasl/sasl/faqs/openldap-sasl-gssapi.html While some distributions change this path to /etc/sasl2/slapd.conf, or /etc/ldap/sasl2/slapd.conf, sasl refers to /usr/lib/sasl2/slapd.conf This slapd.conf must be readable by slapd.
-Dieter
Am Thu, 14 May 2020 13:22:28 -0400 schrieb Braiam braiamp@gmail.com:
Sorry for hijacking this thread.
Hi,
I'm trying to get slapd to use heimdal kerberos to provide a single authentication backend for my network. I've followed the Administrator's Guide on SASL[1] and cyrus faq entry about connecting OpenLDAP with GSSAPI[2]. I'm stuck at the what I believe is a misunderstanding from my part.
[...]
Out of curiosity and facing similar problems, I have just setup a playground mostly based on Raspian, bur additionaly OpenIndiana and OpenSUSE. The Environment: Packages: opensuse: openldap2.2-2.4.50-52.1.x86_64 cyrus-sasl-2.1.27-3.2.x86_64
raspian: slapd/stable,now 2.4.47 libsasl2-modules-gssapi-heimdal/stable 2.1.27 libsasl2-modules-gssapi-mit/stable,now 2.1.27
openindiana: slapd-2.4.48 security/gss@5.11 kernel GSSAPI V2
slapd on opensuse indiana:~$ /usr/lib/openldap/bin/amd64/ldapwhoami -Ygssapi -H ldap://pink.fritz.box SASL/GSSAPI authentication started SASL username: dieter@FRITZ.BOX SASL SSF: 56 SASL data security layer installed. dn:cn=dieter kluenter,ou=partner,o=avci,c=de
raspian:~ $ ldapwhoami -Ygssapi -Hldap://pink.fritz.box SASL/GSSAPI authentication started SASL username: dieter@FRITZ.BOX SASL SSF: 256 SASL data security layer installed. dn:cn=dieter kluenter,ou=partner,o=avci,c=de
slapd on openindiana pink➜ ᐅ ldapwhoami -Ygssapi -H ldap://indiana.fritz.box SASL/GSSAPI authentication started SASL username: dieter@FRITZ.BOX SASL SSF: 256 SASL data security layer installed. dn:uid=dieter@fritz.box,cn=gssapi,cn=auth
slapd on Raspian pink➜ ᐅ ldapwhoami -Ygssapi -H ldap://raspi3.fritz.box SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context
indiana:~$ /usr/lib/openldap/bin/amd64/ldapwhoami -Ygssapi -H ldap://raspi3.fritz.box SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context
KDC is MIT-KRB5
slapd configuration is identical on all hosts, krb5.keytab is individually setup for all hosts, each host has appropriate keys.
If applicable an individual ldap.keytab path is configured in sasl2/slapd.conf this ldap.keytabs are readable by slapd and owned by slapd user and group.
ldap/raspi3.fritz.box@FRITZ.BOX ldap/pink.fritz.box@FRITZ.BOX ldap/indiana.fritz.box@FRITZ.BOX
-Dieter
openldap-technical@openldap.org
-
Andreas Hasenack -
Braiam -
Dieter Klünter