On 5/5/21 9:48 PM, Alan DeKok wrote:
On May 5, 2021, at 3:42 PM, Michael Ströder via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
On 5/5/21 4:43 PM, Alan DeKok wrote:
So far as I know, the OpenLDAP client library doesn't support GSSAPI.
Not true.
It depends on whether it was built with Kerberos support (using MIT Kerberos or heimdal libs). I guess on most Linux systems libldap has SASL/GSSAPI support.
The LDAP module already has a "sasl { .. .}" section. But anything GSSAPI is either unsupported, or is some magic part of sasl which I choose to ignore, because it's too complex. :)
People who are really eager to use Kerberos could probably just set SASL mech GSSAPI and let libkrb5 do the work. Configuration can be done outside of FreeRADIUS with some env vars: https://web.mit.edu/kerberos/krb5-devel/doc/user/user_config/kerberos.html#e... Anyway it's harder to get this right (means secure) than using TLS. Ciao, Michael.