[phpldapadmin] [ phpldapadmin-Patches-3027656 ] Implemented better SASL/GSSAPI authentication

Patches item #3027656, was opened at 2010-07-09 18:19
Message generated for change (Tracker Item Submitted) made by marxarelli
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498548&aid=3027656&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group:  CVS
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Daniel Duvall (marxarelli)
Assigned to: Nobody/Anonymous (nobody)
Summary: Implemented better SASL/GSSAPI authentication

Initial Comment:
Implemented a 'sasl' auth_type for better control over authentication flow specific to SASL.
    
Implemented 'sasl_dn_regex' and 'sasl_dn_replacement' config variables for mapping from a SASL authentication ID to a bind DN, a necessary step when using GSSAPI/Kerberos where there is no explicit bind DN provided.
    
Fixed setting of Kerberos credentials cache location in environment variable. The location is derived from either an already set environement variable or the SERVER variable set by the Apache mod_auth_kerb module. See http://modauthkerb.sourceforge.net/configure.html

----

Note, this patch was tested against an installation of MIT Kerberos V 1.6 and OpenLDAP 2.4.11 with authz-regexp configured to map SASL IDs to DNs. The mod_auth_kerb Apache module is being used to provide the initial Kerberos authentication.

The relevant part of my config follows.

$servers->setValue('login','auth_type','sasl');
$servers->setValue('login','sasl_dn_regex','/^([^@]+)@EXAMPLE\.COM$/');
$servers->setValue('login','sasl_dn_replacement','uid=$1,ou=people,dc=example,dc=com');
$servers->setValue('server','sasl',true);
$servers->setValue('sasl','mech','gssapi');
$servers->setValue('sasl','realm','EXAMPLE.COM');


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498548&aid=3027656&group_id=61828

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/