"Arran" == Arran Cudbard-Bell <a.cudbardb@freeradius.org> writes:
Arran> Regarding LSA/SSPI, I was lead to believe by the Microsoft Arran> docs that LSA plugins could be called via the SSPI interface, Arran> with the SSPI interface being accessible from LDAP SASL Arran> binds. Uh, sort of. SSPI is a lot closer to GSS-API than to SASL. Microsoft doesn't really have a good layer for implementing the layer that would bridge between SASL and SSPI/GSS-API. The gss-eap SSP (RFC 7055/Moonshot as an SSP) has never been tested interoperably as a SASL mechanism. I suspect it would work between two Windows boxes for some applications, bxut very much not work say between a Windows box and cyrus-sasl or gsasl. It's possible work could be done along these lines if someone wanted to, but it won't come cheaply. writing an SSP tends to be fairly involved and tends to involve fairly complex/lrong/expensive debugging sessions. Sam hartman Principal Consultant Painless Security, LLC