[phpldapadmin] [ phpldapadmin-Bugs-3111146 ] SASL authentication broken

Bugs item #3111146, was opened at 2010-11-18 00:28
Message generated for change (Comment added) made by sf-robot
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3111146&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: 1.2.x
>Status: Closed
Resolution: None
Priority: 5
Private: No
Submitted By: Martin Braure de Calignon (error3)
Assigned to: Nobody/Anonymous (nobody)
Summary: SASL authentication broken

Initial Comment:
Hello,

I'm running:
- phpldapadmin (v1.2.0.5)
-  openLDAP 2.4.23
- Apache 2 with mod-auth-krb5 and lot of other one.
- PHP 5.3.3
- Debian/sid

I've just installed phpldapadmin.
Standard connection based on the login and the password works perfectly,
but with sasl it doesn't work at all... I'm using standard configuration of SASL in my firefox (iceweasel) : network.negotiate-auth.* set to my private domain.
SASL already works in apache.
SASL alraedy works in console with ldapsearch, ldapwhoami, ...
example:
$> ldapwhoami 
SASL/GSSAPI authentication started
SASL username: [email protected]
SASL SSF: 56
SASL data security layer installed.
dn:uid=myuser,cn=domain.local,cn=gssapi,cn=auth


I saw on the net that it is known that there might be problems on v1.2.x
What information can I provide to you to help resolving this issue ?


Cheers,

----------------------------------------------------------------------

>Comment By: SourceForge Robot (sf-robot)
Date: 2011-05-26 15:20

Message:
This Tracker item was closed automatically by the system. It was
previously set to a Pending status, and the original submitter
did not respond within 28 days (the time period specified by
the administrator of this Tracker).

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2011-04-28 14:42

Message:
Did you have any luck getting the SASL configuration to work? I'm looking
at releasing an update very soon, and it would be good to close this bug
before doing so :)

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2010-11-19 04:28

Message:
Its not likely that I will have much time in the next few months to work on
SASL/PLA integration, however, hopefully somebody who does use those
environment can contribute some patches to a working configuration.

----------------------------------------------------------------------

Comment By: Martin Braure de Calignon (error3)
Date: 2010-11-19 00:23

Message:
Ok, i've just tried the patch (overriding htdocs/, lib/ directories).
Unfortunately it did not work.
Another thing I did not told you is the modification I made on the code on
top of lib/common.php

if (isset($_SERVER['KRB5CCNAME']))
   putenv("KRB5CCNAME={$_SERVER['KRB5CCNAME']}");

(found on http://left.subtree.org/2007/06/26/phpldapadmin-and-kerberos/)

I'm sure of my config because if I do the following code near the end of
StartSASL (ds_ldap.php)

		 ldap_sasl_bind($resource,$CACHE['login_dn'], $CACHE['login_pass'],
			$this->getValue('sasl','mech'),
			$this->getValue('sasl','realm'),
			$CACHE['authz_id'],
			$this->getValue('sasl','props'));
		$result = ldap_search($resource, 'dc=xmen,dc=local','objectClass
=*');

		for ($c = ldap_first_entry($resource, $result); $c; $c = ldap_ne
xt_entry($resource, $c)) {
			$e = ldap_get_attributes($resource, $c);
			echo "dn: " . ldap_get_dn($resource, $c) . "<br />\n";
			for ($j = 0; $j < $e["count"]; $j++) {
				$a = ldap_get_values($resource, $c, $e[$j]);
				for ($k = 0; $k < $a["count"]; $k++)
					echo $e[$j] . ": " . $a[$k] . "<br />\n"
;
			}
		}
echo 11;
	}


I do get some results.

so perhaps next step should be to provide you some install tips about
kerberos and ldap ?
what do you think ?
Personnaly I follow a lot of differents tutorial found on the net.


----------------------------------------------------------------------

Comment By: Martin Braure de Calignon (error3)
Date: 2010-11-19 00:03

Message:
No I did not try that patch from GIT. I gonna try asap.
to provide a patch, it could be great, but I try to find what's wrong by
doing step by step debugging, and it does not work :-/
for SASL environment there are many things  possible. I use Kerberos +
OpenLDAP
If you have a debian environment I can give you few tips on how to
installs and configure those two softwares.
Another possibility should be I give you an access to my test machine.

So first thing in the action plan:
* trying the patch.

Thanks for you fast answer.

Cheers,

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2010-11-18 22:51

Message:
Martin, you are correct that PLA 1.2 does not have very good SASL support.
While there have been some contributions to provide SASL authentication, I
do not have a SASL environment, nor do I know how to create on to
test/validate their contributions.

There was a patch applied 2 days ago, that provides SASL/GSSAPI
authentication, have you tried that? GIT commit #b3874b.

Otherwise you have a few options:
* Provide a patch that provides SASL support, (from the latest GIT comit)
and/or
* If you provide some links to instructions that detail how to setup a
SASL environment and configure LDAP to use it, and can have a go at
validating the existing contributions, making any fine tunings as
required.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3111146&group_id=61828

------------------------------------------------------------------------------
vRanger cuts backup time in half-while increasing security.
With the market-leading solution for virtual backup and recovery, 
you get blazing-fast, flexible, and affordable data protection.
Download your free trial now. 
http://p.sf.net/sfu/quest-d2dcopy1
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/