[phpldapadmin] SASL/GSSAPI

Hello list...

I've been working on getting PLA to work in my environment with
SASL/GSSAPI authentication.  I was able to make it work, but it did
require a few modifications to PLA (I believe only one of them is GSSAPI
specific).

Attached is the patch file I generated via `diff ds_ldap.php
ds_ldap.php.orig`.  Forgive me if I did this part backwards.

With these modifications PLA is working in my environment on apache
2.2.11, php 5.2.10-p10-gentoo, mod_fastcgi, and mod_auth_kerb 5.4.

There is one issue I have yet to resolve, which I will try to explain.  If
you attempt to move through the ldap tree quickly, you will receive a
javascript popup "There was a problem with the request".  On the backend,
the SASL bind is failing, with an error that 'no credential cache was
found'.  It appears that authentication is cached by apache or
mod_auth_kerb, thus, a new credential cache is not created and the bind
fails.  This can be solved by waiting 10-30 seconds before performing each
function in PLA (slightly annoying, but it works).  Maybe that makes
sense.  I'm not 100% sure where the issue lies, so I have not been able to
come up with a solution.  My guess is mod_auth_kerb, but I'm not an
experienced enough php programmer to know if there would be something that
could fix this on the PLA side.

I was not able to make this work using php as a module, as noted above, I
had to use fastcgi.  I could not get the environment to set correctly I
believe and the binds would fail with a 'credential cache permissions
incorrect' error (though the credential cache file was owned by apache
w/0600 permissions).

I'm happy to provide any additional assistance or testing with regards to
this.

Thanks,

ethan

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with 
Crystal Reports now.  http://p.sf.net/sfu/bobj-july

______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/

197c197
<                       $bind['result'] = $this->startSASL($resource,$method);
---
>                       $this->startSASL($resource,$method);
606,614c606
<               if (strcasecmp($this->getValue('sasl','mech'), "gssapi") == 0) {
<                       if (isset($_ENV['REDIRECT_KRB5CCNAME'])) {
<                               putenv("KRB5CCNAME={$_ENV['REDIRECT_KRB5CCNAME']}");
<                       }
<               } else {
<                       error(__METHOD__.' has NOT been tested, please let us know if it works and which version of PHP you are using.','info');
<               }
<
<
---
>               error(__METHOD__.' has NOT been tested, please let us know if it works and which version of PHP you are using.','info');
617c609
<               if (! $this->getValue('server','sasl') || ! function_exists('ldap_start_tls'))
---
>               if (! $this->getValue('server','sasl') || ! function_exists('ldap_start_tls'));
659,660c651
<                       $CACHE['authz_id'],
<                       Null,
---
>                       $CACH['authz_id'],