On Oct 26, 2022, at 9:57 AM, Adam Bishop via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I'm working on rebuilding our internal RADIUS systems, using the Network RADIUS packages rather than our own.
Our LDAP configuration uses SASL to authenticate to 389ds via a UNIX socket - works OK on RHEL 7.
The RHEL 8 hosts though (with the LTB packages) fail with:
... rlm_ldap: libldap vendor: OpenLDAP, version: 20459 Configuration item 'sasl.mech' not supported. Linked libldap does not provide ldap_sasl_interactive_bind function ...
As far as I can tell, the ltb LDAP does export that symbol:
# nm -gD /usr/local/openldap/lib64/libldap.so | grep ldap_sasl_interactive_bind 0000000000017760 T ldap_sasl_interactive_bind 00000000000178c0 T ldap_sasl_interactive_bind_s
So I'm guessing that the ltb libldap isn't being linked at runtime?
The error from FreeRADIUS is a *build* error. i.e. at build time, the build determined that libldap didn't have ldap_sasl_interactive_bind. And then refuses to even use it. What happens at run time doesn't matter, because FreeRADIUS isn't even trying to use that function.
If that's the case, is there a way to configure FreeRADIUS to use the ltb versions, or do I need to start overriding LD_PRELOAD_PATH/hand edit ld.conf? I'm not 100% sure how it would be linking at the moment, as I don't see the ltb so's in the output of ldconfig.
You'll need to rebuild FreeRADIUS.
Or am I just completely wrong and the ltb packages don't support SASL :)
It looks like they don't. Sometimes libraries have "stub" symbols which don't work. :( Alan DeKok.