Network RADIUS packages and LDAP/SASL
I'm working on rebuilding our internal RADIUS systems, using the Network RADIUS packages rather than our own. Our LDAP configuration uses SASL to authenticate to 389ds via a UNIX socket - works OK on RHEL 7. The RHEL 8 hosts though (with the LTB packages) fail with: ... rlm_ldap: libldap vendor: OpenLDAP, version: 20459 Configuration item 'sasl.mech' not supported. Linked libldap does not provide ldap_sasl_interactive_bind function ... As far as I can tell, the ltb LDAP does export that symbol: # nm -gD /usr/local/openldap/lib64/libldap.so | grep ldap_sasl_interactive_bind 0000000000017760 T ldap_sasl_interactive_bind 00000000000178c0 T ldap_sasl_interactive_bind_s So I'm guessing that the ltb libldap isn't being linked at runtime? If that's the case, is there a way to configure FreeRADIUS to use the ltb versions, or do I need to start overriding LD_PRELOAD_PATH/hand edit ld.conf? I'm not 100% sure how it would be linking at the moment, as I don't see the ltb so's in the output of ldconfig. Or am I just completely wrong and the ltb packages don't support SASL :) Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
On Oct 26, 2022, at 9:57 AM, Adam Bishop via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I'm working on rebuilding our internal RADIUS systems, using the Network RADIUS packages rather than our own.
Our LDAP configuration uses SASL to authenticate to 389ds via a UNIX socket - works OK on RHEL 7.
The RHEL 8 hosts though (with the LTB packages) fail with:
... rlm_ldap: libldap vendor: OpenLDAP, version: 20459 Configuration item 'sasl.mech' not supported. Linked libldap does not provide ldap_sasl_interactive_bind function ...
As far as I can tell, the ltb LDAP does export that symbol:
# nm -gD /usr/local/openldap/lib64/libldap.so | grep ldap_sasl_interactive_bind 0000000000017760 T ldap_sasl_interactive_bind 00000000000178c0 T ldap_sasl_interactive_bind_s
So I'm guessing that the ltb libldap isn't being linked at runtime?
The error from FreeRADIUS is a *build* error. i.e. at build time, the build determined that libldap didn't have ldap_sasl_interactive_bind. And then refuses to even use it. What happens at run time doesn't matter, because FreeRADIUS isn't even trying to use that function.
If that's the case, is there a way to configure FreeRADIUS to use the ltb versions, or do I need to start overriding LD_PRELOAD_PATH/hand edit ld.conf? I'm not 100% sure how it would be linking at the moment, as I don't see the ltb so's in the output of ldconfig.
You'll need to rebuild FreeRADIUS.
Or am I just completely wrong and the ltb packages don't support SASL :)
It looks like they don't. Sometimes libraries have "stub" symbols which don't work. :( Alan DeKok.
On 26 Oct 2022, at 15:29, Alan DeKok <aland@deployingradius.com> wrote:
The error from FreeRADIUS is a *build* error. i.e. at build time, the build determined that libldap didn't have ldap_sasl_interactive_bind. And then refuses to even use it.
What happens at run time doesn't matter, because FreeRADIUS isn't even trying to use that function.
Ah, that makes sense.
You'll need to rebuild FreeRADIUS.
That's easy enough - just did a quick test (haven't pushed it into production to confirm any SASL mechs are usable) but adding `cyrus-sasl-devel` to the spec as a BuildRequire seems to change the configure output: Before: ... checking for ldap_sasl_interactive_bind... yes ... checking for sasl/sasl.h in /usr/local/openldap/include/... no checking for sasl/sasl.h... no checking for sasl/sasl.h in /usr/local/include/... no checking for sasl/sasl.h in /opt/include/... no ... After: ... checking for ldap_sasl_interactive_bind... yes ... checking for sasl/sasl.h in /usr/local/openldap/include/... yes ... Though, `sasl.h` isn't in or linked to `/usr/local/openldap/include/` - autoconf weirdness? WITH_SASL does get defined regardless of the path ./configure prints. Thanks for the pointers, Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800. For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
participants (2)
-
Adam Bishop -
Alan DeKok