11:45 a.m.
The goal: to make an OpenLDAP server to authenticate using Kerberos V via GSSAPI
Setup: several virtual machines running on freshly installed/updated
Debian Squeeze
A master KDC server
kdc.example.com
A LDAP server, running OpenLDAP
ldap.example.com
The problem:
tom@ldap:~$ ldapsearch -b 'dc=example,dc=com'
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80)
additional info: SASL(-1): generic failure: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (Key
table entry not found)
One might suggest to add that keytab entry, but:
ktutil: rkt /etc/ldap/ldap.keytab
ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 2 ldap/ldap.example.com(a)EXAMPLE.COM
2 2 ldap/ldap.example.com(a)EXAMPLE.COM
3 2 ldap/ldap.example.com(a)EXAMPLE.COM
4 2 ldap/ldap.example.com(a)EXAMPLE.COM
So, the entry as suggested by the OpenLDAP manual is there allright.
Deleting and re-creating both service principal and the keytab on
ldap.example.com didn't help, I get the same error. And before I make
the keytab file readable by openldap, I get "Permission denied" error
instead of the one in the subject. Which implies that the right keytab
file is being accessed, as set in /etc/default/slapd.
I have my doubts about the following part of slapd config:
root@ldap:~# cat /etc/ldap/slapd.d/cn\=config.ldif | grep -v "^#"
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/slapd/slapd.args
olcLogLevel: 256
olcPidFile: /var/run/slapd/slapd.pid
olcToolThreads: 1
structuralObjectClass: olcGlobal
entryUUID: d6737f5c-d321-1030-9dbe-27d2a7751e11
olcSaslHost: kdc.example.com
olcSaslRealm: EXAMPLE.COM
olcSaslSecProps: noplain,noactive,noanonymous,minssf=56
olcAuthzRegexp: {0}"uid=([^/]*),cn=EXAMPLE.COM,cn=GSSAPI,cn=auth"
"uid=$1,ou=People,dc=example,dc=com"
olcAuthzRegexp:
{1}"uid=host/([^/]*).example.com,cn=example.com,cn=gssapi,cn=auth"
"cn=$1,ou=hosts,dc=example,dc=com"
A HOWTO at https://help.ubuntu.com/community/OpenLDAPServer#Kerberos_Authentication
mentiones:
Also, it is frequently necessary to map the Distinguished Name
(DN) of an authorized Kerberos client to an existing entry in the DIT.
I fail to understand where in the tree this should be defined, what
schema should be used, etc. After hours of googling, it's official:
I'm stuck! Please, help.
Other things checked: Kerberos as such works fine (I can ssh without
using a password to any machine in this setup). That means there
should be no DNS-related problems.
ldapsearch -b 'dc=example,dc=com' -x
works OK.
SASL/GSSAPI has been tested using
sasl-sample-server -m GSSAPI -s ldap
and
sasl-sample-client -s ldap -n ldap.example.com -u tom
without errors:
root@ldap:~# sasl-sample-server -m GSSAPI -s ldap
Forcing use of mechanism GSSAPI
Sending list of 1 mechanism(s)
S: R1NTQVBJ
Waiting for client mechanism...
C:
R1NTQVBJAGCCAmUGCSqGSIb3EgECAgEAboICVDCCAlCgAwIBBaEDAgEOogcDBQAgAAAAo4IBamGCAWYwggFioAMCAQWhDRsLRVhBTVBMRS5DT02iIzAhoAMCAQOhGjAYGwRsZGFwGxBsZGFwLmV4YW1wbGUuY29to4IBJTCCASGgAwIBEqEDAgECooIBEwSCAQ8Re8XUnscB8dx6V/cXL+uzSF2/olZvcrVAJHZBZrfRKUFEQmU1Li46bUGK3GZwsn6qUVwmW6lyqVctOIYwGvBpz81Rw/5mj4V5iQudZbIRa+5Ew6W1oBB7ALi2cnPsbUroqzGmEh8/Vw8zSFk7W1gND4DLuWrPXD2xhLDUMMekBn5nXEPTnNAnV4w81Sj3ZlyLZz5OSitGVUEnQweV53z1spWsASHHWod/tSuxb19YeWmY5QHXPLG+lL5+w+Cykr0EhYVj8f8MDWFB8qoN1cr85xDfn18r8JldSw+i18nFKOo8usG+37hZTWynHYvBfMONtG9mLJv82KGPZMydWK7pzyTZDcnSsIjo2AftMZd5pIHMMIHJoAMCARKigcEEgb5aG1k4xgxmUXX7RKfvAbVBVJ12dWOgFFjMYceKjziXwrrOkv8ZwIvef9Yn2KsWznb5L55SXt2c/zlPa5mLKIktvw77hsK1h/GYc7p//BGOsmr47aCqVWsGuTqVT129uo5LNQDeSFwl2jXCkCZJZavOVrqYsM6flrPYE4n5lASTcPitX+/WNsf6WrvZoaexiv1JqyM/MWqS/vMBRMMc5xlurj6OARFvP9aFZoK/BLmfkSyAJj6MLbLVXZtkHiIPgot
'GSSAPI'
Sending response...
S:
YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvkxggi9pW+yJ1ExbTwLDclqw/VQ98aPq8mt39hkO6PPfcO2cB+t6vJ01xRKBrT9D2qF2XK0SWD4PQNb5UFbH4RM/bKAxDuCfZ1MHKgIWTLu4bK7VGZTbYydcckU2d910jIdvkkHhaRqUEM4cqp/cR
Waiting for client reply...
C: got ''
Sending response...
S: BQQF/wAMAAAAAAAAMBOWqQcACAAlCodrXW66ZObsEd4=
Waiting for client reply...
C: BQQE/wAMAAAAAAAAFUYbXQQACAB0b20VynB4uGH/iIzoRhw=got '?'
Negotiation complete
Username: tom
Realm: (NULL)
SSF: 56
sending encrypted message 'srv message 1'
S:
AAAASgUEB/8AAAAAAAAAADATlqrqrBW0NRfPMXMdMz+zqY32YakrHqFps3o/vO6yDeyPSaSqprrhI+t7owk7iOsbrZ/idJRxCBm8Wazx
Waiting for encrypted message...
C:
AAAATQUEBv8AAAAAAAAAABVGG17WC1+/kIV9xTMUdq6Y4qYmmTahHVCjidgGchTOOOrBLEwA9IqiTCdRFPVbK1EgJ34P/vxMQpV1v4WZpcztgot
''
recieved decoded message 'client message 1'
root@ldap:~# sasl-sample-client -s ldap -n ldap.example.com -u tom
service=ldap
Waiting for mechanism list from server...
S: R1NTQVBJrecieved 6 byte message
Choosing best mechanism from: GSSAPI
returning OK: tom
Using mechanism GSSAPI
Preparing initial.
Sending initial response...
C:
R1NTQVBJAGCCAmUGCSqGSIb3EgECAgEAboICVDCCAlCgAwIBBaEDAgEOogcDBQAgAAAAo4IBamGCAWYwggFioAMCAQWhDRsLRVhBTVBMRS5DT02iIzAhoAMCAQOhGjAYGwRsZGFwGxBsZGFwLmV4YW1wbGUuY29to4IBJTCCASGgAwIBEqEDAgECooIBEwSCAQ8Re8XUnscB8dx6V/cXL+uzSF2/olZvcrVAJHZBZrfRKUFEQmU1Li46bUGK3GZwsn6qUVwmW6lyqVctOIYwGvBpz81Rw/5mj4V5iQudZbIRa+5Ew6W1oBB7ALi2cnPsbUroqzGmEh8/Vw8zSFk7W1gND4DLuWrPXD2xhLDUMMekBn5nXEPTnNAnV4w81Sj3ZlyLZz5OSitGVUEnQweV53z1spWsASHHWod/tSuxb19YeWmY5QHXPLG+lL5+w+Cykr0EhYVj8f8MDWFB8qoN1cr85xDfn18r8JldSw+i18nFKOo8usG+37hZTWynHYvBfMONtG9mLJv82KGPZMydWK7pzyTZDcnSsIjo2AftMZd5pIHMMIHJoAMCARKigcEEgb5aG1k4xgxmUXX7RKfvAbVBVJ12dWOgFFjMYceKjziXwrrOkv8ZwIvef9Yn2KsWznb5L55SXt2c/zlPa5mLKIktvw77hsK1h/GYc7p//BGOsmr47aCqVWsGuTqVT129uo5LNQDeSFwl2jXCkCZJZavOVrqYsM6flrPYE4n5lASTcPitX+/WNsf6WrvZoaexiv1JqyM/MWqS/vMBRMMc5xlurj6OARFvP9aFZoK/BLmfkSyAJj6MLbLVXZtkHiIP
Waiting for server reply...
S:
YIGZBgkqhkiG9xIBAgICAG+BiTCBhqADAgEFoQMCAQ+iejB4oAMCARKicQRvkxggi9pW+yJ1ExbTwLDclqw/VQ98aPq8mt39hkO6PPfcO2cB+t6vJ01xRKBrT9D2qF2XK0SWD4PQNb5UFbH4RM/bKAxDuCfZ1MHKgIWTLu4bK7VGZTbYydcckU2d910jIdvkkHhaRqUEM4cqp/cRrecieved
156 byte message
C:
Waiting for server reply...
S: BQQF/wAMAAAAAAAAMBOWqQcACAAlCodrXW66ZObsEd4=recieved 32 byte message
Sending response...
C: BQQE/wAMAAAAAAAAFUYbXQQACAB0b20VynB4uGH/iIzoRhw=
Negotiation complete
Username: tom
SSF: 56
Waiting for encoded message...
S:
AAAASgUEB/8AAAAAAAAAADATlqrqrBW0NRfPMXMdMz+zqY32YakrHqFps3o/vO6yDeyPSaSqprrhI+t7owk7iOsbrZ/idJRxCBm8Wazxrecieved
78 byte message
recieved decoded message 'srv message 1'
sending encrypted message 'client message 1'
C:
AAAATQUEBv8AAAAAAAAAABVGG17WC1+/kIV9xTMUdq6Y4qYmmTahHVCjidgGchTOOOrBLEwA9IqiTCdRFPVbK1EgJ34P/vxMQpV1v4WZpczt
12:16 p.m.
On 01/17/12 21:45 +0200, Toomas Vendelin wrote:
The goal: to make an OpenLDAP server to authenticate using Kerberos V
via GSSAPI
Setup: several virtual machines running on freshly installed/updated
Debian Squeeze
A master KDC server
kdc.example.com
A LDAP server, running OpenLDAP
ldap.example.com
The problem:
tom@ldap:~$ ldapsearch -b 'dc=example,dc=com'
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80)
additional info: SASL(-1): generic failure: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information (Key
table entry not found)
One might suggest to add that keytab entry, but:
ktutil: rkt /etc/ldap/ldap.keytab
ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 2 ldap/ldap.example.com(a)EXAMPLE.COM
2 2 ldap/ldap.example.com(a)EXAMPLE.COM
3 2 ldap/ldap.example.com(a)EXAMPLE.COM
4 2 ldap/ldap.example.com(a)EXAMPLE.COM
So, the entry as suggested by the OpenLDAP manual is there allright.
Deleting and re-creating both service principal and the keytab on
ldap.example.com didn't help, I get the same error. And before I make
the keytab file readable by openldap, I get "Permission denied" error
instead of the one in the subject. Which implies that the right keytab
file is being accessed, as set in /etc/default/slapd.
I have my doubts about the following part of slapd config:
root@ldap:~# cat /etc/ldap/slapd.d/cn\=config.ldif | grep -v "^#"
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/slapd/slapd.args
olcLogLevel: 256
olcPidFile: /var/run/slapd/slapd.pid
olcToolThreads: 1
structuralObjectClass: olcGlobal
entryUUID: d6737f5c-d321-1030-9dbe-27d2a7751e11
olcSaslHost: kdc.example.com
I think you'll find that libsasl2 is searching for ldap/kdc.example.com in
your credentials cache. Try changing this to:
olcSaslHost: ldap.example.com
olcSaslRealm: EXAMPLE.COM
olcSaslSecProps: noplain,noactive,noanonymous,minssf=56
olcAuthzRegexp: {0}"uid=([^/]*),cn=EXAMPLE.COM,cn=GSSAPI,cn=auth"
"uid=$1,ou=People,dc=example,dc=com"
olcAuthzRegexp:
{1}"uid=host/([^/]*).example.com,cn=example.com,cn=gssapi,cn=auth"
"cn=$1,ou=hosts,dc=example,dc=com"
A HOWTO at https://help.ubuntu.com/community/OpenLDAPServer#Kerberos_Authentication
mentiones:
Also, it is frequently necessary to map the Distinguished Name
(DN) of an authorized Kerberos client to an existing entry in the DIT.
I fail to understand where in the tree this should be defined, what
schema should be used, etc. After hours of googling, it's official:
I'm stuck! Please, help.
When I was learning how to map entries, I found ldapwhoami to be very
useful. As an example, you might see this *before* creating any authz-regex
maps:
$ ldapwhoami -Y gssapi -H ldap://ldap.example.com
SASL/GSSAPI authentication started
SASL username: ...
SASL SSF: 56
SASL data security layer installed.
dn:uid=jsmith@EXAMPLE.COM,cn=GSSAPI,cn=auth
Then, you can create your maps piecemeal wise until your identity becomes
what you really what it to be, e.g.:
dn:uid=jsmith,ou=people,dc=example,dc=com
See chapter 15 of the openldap administrator's guide for examples, and then
see the manpage for slapd-config for details on how to create the
corresponding olcAuthzRegexp entries.
--
Dan White
1:06 a.m.
Thank you, Dan!
Indeed, setting
olcSaslHost: ldap.example.com
instead of
olcSaslHost: kdc.example.com
solves the issue.
Now, when I look back for what caused me this hiccup, this has come to
my attention:
- in slapd-config(5):
olcSaslHost: <fqdn>
Used to specify the fully qualified domain name used for SASL processing.
... the description looks somewhat ambiguous to me. It would be less
confusion, if it were "Host running a LDAP server" or similar. Or
perhaps just warning of a possible pitfall - my five cents :).
And, of course, the Ubuntu tutorial page, that was plain whong, saying:
"#The FQDN of the Kerberos KDC.
olcSaslHost: kerberos.example.com"
at https://help.ubuntu.com/community/OpenLDAPServer#Kerberos_Authentication
But again, many thanks for a quick and helpful response!
Toomas
On Tue, Jan 17, 2012 at 10:16 PM, Dan White <dwhite(a)olp.net> wrote:
On 01/17/12 21:45 +0200, Toomas Vendelin wrote:
>
> The goal: to make an OpenLDAP server to authenticate using Kerberos V via
> GSSAPI
>
> Setup: several virtual machines running on freshly installed/updated
> Debian Squeeze
>
> A master KDC server
>
> kdc.example.com
>
> A LDAP server, running OpenLDAP
>
> ldap.example.com
>
> The problem:
>
> tom@ldap:~$ ldapsearch -b 'dc=example,dc=com'
> SASL/GSSAPI authentication started
> ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error
> (80)
> additional info: SASL(-1): generic failure: GSSAPI Error:
> Unspecified GSS failure. Minor code may provide more information (Key
> table entry not found)
>
> One might suggest to add that keytab entry, but:
>
> ktutil: rkt /etc/ldap/ldap.keytab
> ktutil: list
> slot KVNO Principal
> ---- ----
> ---------------------------------------------------------------------
> 1 2 ldap/ldap.example.com(a)EXAMPLE.COM
> 2 2 ldap/ldap.example.com(a)EXAMPLE.COM
> 3 2 ldap/ldap.example.com(a)EXAMPLE.COM
> 4 2 ldap/ldap.example.com(a)EXAMPLE.COM
>
> So, the entry as suggested by the OpenLDAP manual is there allright.
> Deleting and re-creating both service principal and the keytab on
> ldap.example.com didn't help, I get the same error. And before I make
> the keytab file readable by openldap, I get "Permission denied" error
> instead of the one in the subject. Which implies that the right keytab
> file is being accessed, as set in /etc/default/slapd.
>
> I have my doubts about the following part of slapd config:
>
> root@ldap:~# cat /etc/ldap/slapd.d/cn\=config.ldif | grep -v "^#"
> dn: cn=config
> objectClass: olcGlobal
> cn: config
> olcArgsFile: /var/run/slapd/slapd.args
> olcLogLevel: 256
> olcPidFile: /var/run/slapd/slapd.pid
> olcToolThreads: 1
> structuralObjectClass: olcGlobal
> entryUUID: d6737f5c-d321-1030-9dbe-27d2a7751e11
> olcSaslHost: kdc.example.com
I think you'll find that libsasl2 is searching for ldap/kdc.example.com in
your credentials cache. Try changing this to:
olcSaslHost: ldap.example.com
> olcSaslRealm: EXAMPLE.COM
> olcSaslSecProps: noplain,noactive,noanonymous,minssf=56
> olcAuthzRegexp: {0}"uid=([^/]*),cn=EXAMPLE.COM,cn=GSSAPI,cn=auth"
> "uid=$1,ou=People,dc=example,dc=com"
> olcAuthzRegexp:
> {1}"uid=host/([^/]*).example.com,cn=example.com,cn=gssapi,cn=auth"
> "cn=$1,ou=hosts,dc=example,dc=com"
>
> A HOWTO at
> https://help.ubuntu.com/community/OpenLDAPServer#Kerberos_Authentication
> mentiones:
>
> Also, it is frequently necessary to map the Distinguished Name
> (DN) of an authorized Kerberos client to an existing entry in the DIT.
>
> I fail to understand where in the tree this should be defined, what
> schema should be used, etc. After hours of googling, it's official:
> I'm stuck! Please, help.
When I was learning how to map entries, I found ldapwhoami to be very
useful. As an example, you might see this *before* creating any authz-regex
maps:
$ ldapwhoami -Y gssapi -H ldap://ldap.example.com
SASL/GSSAPI authentication started
SASL username: ...
SASL SSF: 56
SASL data security layer installed.
dn:uid=jsmith@EXAMPLE.COM,cn=GSSAPI,cn=auth
Then, you can create your maps piecemeal wise until your identity becomes
what you really what it to be, e.g.:
dn:uid=jsmith,ou=people,dc=example,dc=com
See chapter 15 of the openldap administrator's guide for examples, and then
see the manpage for slapd-config for details on how to create the
corresponding olcAuthzRegexp entries.
--
Dan White
4:38 a.m.
On Wednesday, 18 January 2012 11:06:45 Toomas Vendelin wrote:
Thank you, Dan!
Indeed, setting
olcSaslHost: ldap.example.com
instead of
olcSaslHost: kdc.example.com
solves the issue.
Now, when I look back for what caused me this hiccup, this has come to
my attention:
- in slapd-config(5):
olcSaslHost: <fqdn>
Used to specify the fully qualified domain name used for SASL
processing.
... the description looks somewhat ambiguous to me.
SASL an be a bit ambiguous, and I don't see that the documentation should
necessarily cover specific SASL mechs, that is the responsibility of the SASL
layer.
It would be less
confusion, if it were "Host running a LDAP server" or similar.
But, that is the default (IOW, when you do not specify olcSaslHost it will use
the hostname of the server slapd is running on).
Or
perhaps just warning of a possible pitfall - my five cents :).
And, of course, the Ubuntu tutorial page, that was plain whong, saying:
"#The FQDN of the Kerberos KDC.
olcSaslHost: kerberos.example.com"
at https://help.ubuntu.com/community/OpenLDAPServer#Kerberos_Authentication
So one wonders why we are discussing it on this list ....
Regards,
Buchan
4039
days inactive
4040
days old
openldap-technical@openldap.org
3 comments
3 participants
participants (3)
-
Buchan Milne -
Dan White -
Toomas Vendelin