[phpldapadmin] [ phpldapadmin-Patches-3027656 ] Implemented better SASL/GSSAPI authentication

Patches item #3027656, was opened at 2010-07-10 11:19
Message generated for change (Comment added) made by wurley
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498548&aid=3027656&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group:  CVS
>Status: Closed
>Resolution: Accepted
Priority: 5
Private: No
Submitted By: Daniel Duvall (marxarelli)
Assigned to: Nobody/Anonymous (nobody)
Summary: Implemented better SASL/GSSAPI authentication

Initial Comment:
Implemented a 'sasl' auth_type for better control over authentication flow specific to SASL.
    
Implemented 'sasl_dn_regex' and 'sasl_dn_replacement' config variables for mapping from a SASL authentication ID to a bind DN, a necessary step when using GSSAPI/Kerberos where there is no explicit bind DN provided.
    
Fixed setting of Kerberos credentials cache location in environment variable. The location is derived from either an already set environement variable or the SERVER variable set by the Apache mod_auth_kerb module. See http://modauthkerb.sourceforge.net/configure.html

----

Note, this patch was tested against an installation of MIT Kerberos V 1.6 and OpenLDAP 2.4.11 with authz-regexp configured to map SASL IDs to DNs. The mod_auth_kerb Apache module is being used to provide the initial Kerberos authentication.

The relevant part of my config follows.

$servers->setValue('login','auth_type','sasl');
$servers->setValue('login','sasl_dn_regex','/^([^@]+)@EXAMPLE\.COM$/');
$servers->setValue('login','sasl_dn_replacement','uid=$1,ou=people,dc=example,dc=com');
$servers->setValue('server','sasl',true);
$servers->setValue('sasl','mech','gssapi');
$servers->setValue('sasl','realm','EXAMPLE.COM');


----------------------------------------------------------------------

>Comment By: Deon George (wurley)
Date: 2010-11-16 22:15

Message:
Thanks.

I havent got a SASL environment, but I've applied your patch as is.

Commit #b3874bf

----------------------------------------------------------------------

Comment By: Daniel Duvall (marxarelli)
Date: 2010-07-10 11:23

Message:
The Apache config may also be relevant and useful in testing.

    # Kerberos authentication
    AuthType KerberosV5
    AuthName "LDAP Admin"
    KrbAuthRealms EXAMPLE.COM
    Krb5KeyTab apache.keytab
    KrbServiceName HTTP
    KrbMethodK5Passwd off
    KrbMethodNegotiate on
    KrbSaveCredentials on
    require user [email protected]

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498548&aid=3027656&group_id=61828

------------------------------------------------------------------------------
Beautiful is writing same markup. Internet Explorer 9 supports
standards for HTML5, CSS3, SVG 1.1,  ECMAScript5, and DOM L2 & L3.
Spend less time writing and  rewriting code and more time creating great
experiences on the web. Be a part of the beta today
http://p.sf.net/sfu/msIE9-sfdev2dev
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/