[phpldapadmin] [ phpldapadmin-Patches-3027656 ] Implemented better SASL/GSSAPI authentication

Patches item #3027656, was opened at 2010-07-09 18:19
Message generated for change (Comment added) made by marxarelli
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498548&aid=3027656&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group:  CVS
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: Daniel Duvall (marxarelli)
Assigned to: Nobody/Anonymous (nobody)
Summary: Implemented better SASL/GSSAPI authentication

Initial Comment:
Implemented a 'sasl' auth_type for better control over authentication flow specific to SASL.
    
Implemented 'sasl_dn_regex' and 'sasl_dn_replacement' config variables for mapping from a SASL authentication ID to a bind DN, a necessary step when using GSSAPI/Kerberos where there is no explicit bind DN provided.
    
Fixed setting of Kerberos credentials cache location in environment variable. The location is derived from either an already set environement variable or the SERVER variable set by the Apache mod_auth_kerb module. See http://modauthkerb.sourceforge.net/configure.html

----

Note, this patch was tested against an installation of MIT Kerberos V 1.6 and OpenLDAP 2.4.11 with authz-regexp configured to map SASL IDs to DNs. The mod_auth_kerb Apache module is being used to provide the initial Kerberos authentication.

The relevant part of my config follows.

$servers->setValue('login','auth_type','sasl');
$servers->setValue('login','sasl_dn_regex','/^([^@]+)@EXAMPLE\.COM$/');
$servers->setValue('login','sasl_dn_replacement','uid=$1,ou=people,dc=example,dc=com');
$servers->setValue('server','sasl',true);
$servers->setValue('sasl','mech','gssapi');
$servers->setValue('sasl','realm','EXAMPLE.COM');


----------------------------------------------------------------------

>Comment By: Daniel Duvall (marxarelli)
Date: 2010-07-09 18:23

Message:
The Apache config may also be relevant and useful in testing.

    # Kerberos authentication
    AuthType KerberosV5
    AuthName "LDAP Admin"
    KrbAuthRealms EXAMPLE.COM
    Krb5KeyTab apache.keytab
    KrbServiceName HTTP
    KrbMethodK5Passwd off
    KrbMethodNegotiate on
    KrbSaveCredentials on
    require user [email protected]

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498548&aid=3027656&group_id=61828

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/