On Tue, Jun 16, 2015 at 5:55 AM, Arran Cudbard-Bell <a.cudbardb@freeradius.org> wrote:
On 15 Jun 2015, at 21:07, Isaac Boukris <iboukris@gmail.com> wrote: Then it worked with simple-bind for admin auth so I tried to set: mech = 'GSSAPI' And then I got auth failure which - from the wireshark traces - I think was related to 'identity' directive being set with a DN so I comment it out (along with the 'password' directive) as it should not be necessary.
Well you control the value sent in identity. So if it was a DN that's what you had in the config file... I hope?
Yea, it was the DN of the same user principle that's in the keytab. Perhaps specifying it implies simple-bind (no sasl).
Now it works fine with Kerberos auth for admin searches using the KRB5_CLIENT_KTNAME but the fun part is when I set: mech = 'GSS-SPNEGO' It uses spnego and when KRB5_CLIENT_KTNAME is not available it fails-over to using my NTLM system credentials and works fine (lookup gss-ntlmssp for details).
Hehe, as it should I guess, that's neat.
Yes, funny how many pseudo mechanism though - sasl(gssapi(spnego(actual_mech))) ;-) However, I just found out it doesn't fully work well yet :-( The bind succeed but later when radiusd makes a search query the LDAP (AD) simply does not respond (it does respond if simple-bind is used). It puzzled me for a while till I compared network traces with the equivalent "ldapsearch -Y GSSAPI" command. It appears that when GSSAPI is used then 'ldapsearch' will also use an encryption wrapping scheme to envelop the subsequent search requests to the server. My guess is that the server does not respond because it expect that (see attached capture - at the very end you can see the successful ldapsearch). Need to look into it, perhaps it's negotiable or some sasl library calls should be changed. I'll try to look into ldapsearch code and investigate further - ideas of solutions are welcome :)
Thankyou very much for testing and providing feedback. I've pushed fixes for the issues you've encountered and updated the default ldap config file.
I can confirm the crashes are gone and it works well. I still have the linkage run time issue unless I add 'sasl.c' to 'rlm_ldap/all.mk.in' with v3.0 (no build-tools expert). Thank you guys for this great and open source software.