[phpldapadmin] [ phpldapadmin-Bugs-3317146 ] sasl auth options unsupported

Bugs item #3317146, was opened at 2011-06-15 21:52
Message generated for change (Comment added) made by malibee
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3317146&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: Fixed
Priority: 5
Private: No
Submitted By: Despot (malibee)
Assigned to: Nobody/Anonymous (nobody)
Summary: sasl auth options unsupported

Initial Comment:
- phpldadmin 1.2.1.1, direct download from Sourceforge
- OpenLDAP 2.4.21
- Apache 2.2.14
- PHP 5.3.2
- Ubuntu 10.04 (Lucid Lynx)

1. Rename config.php.example to config.php. Seems to work fine (I didn't test this extensively, but the login screen is displayed). 
2. Uncomment this line in the otherwise unmodified config.php file:

$servers->setValue('server','sasl_auth',false);

The following error results:

"Function error called incorrectly [ERROR: Setting a index [server,sasl_auth] that isnt predefined.]"

This is almost certainly a dupe of #3111146, but I don't know of a way to add myself as an affected user. The issue is show-stopper for me, so I'd like to put a bounty on it. I will donate $20 to the project once the bug is fixed.

----------------------------------------------------------------------

>Comment By: Despot (malibee)
Date: 2011-06-20 23:24

Message:
This snippet from the PLA log file seems relevant:

[0.000]              ds(0072-017): .DS::getValue: Entered (sasl|mech)
[0.000]              ds(0072-017): .DS::getValue: Entered (sasl|realm)
[0.000]              ds(0072-017): .DS::getValue: Entered (sasl|props)
[0.008]       functions(0124-001): app_error_handler: Entered
(2|ldap_sasl_bind(): Unable to bind to server: Local
error|/usr/share/phpldapadmin/lib/ds_ldap.php|664|a:4:{s:8:"resource";i:0;s:6:"method";s:4:"user";s:5:"fargs";a:2:{i:0;i:0;i:1;s:4:"user";}
[0.001]         ds_ldap(0202-016): ldap::connect: Resource [Resource id
#25], Bind Result
[a:3:{s:2:"id";s:28:"kerberosPrincipal@REALM";s:4:"pass";s:0:"";s:6:"result";b:0;}]
[0.000]         ds_ldap(0206-016): ldap::connect: Leaving with FALSE, bind
FAILed

----------------------------------------------------------------------

Comment By: Despot (malibee)
Date: 2011-06-20 23:07

Message:
Getting closer...the PLA interface comes up, but binding to the directory
fails. The slapd logs indicate the connection is made, and then immediately
dropped. I'm going to have to look into this tomorrow; it's not immediately
apparent if this is a configuration issue or a result of the bug. It looks
as if PLA is trying to bind anonymously, but I haven't figured out a way to
get PLA to print the bind DN in its debug output.

For your reading pleasure, here's the configuration I'm using (*shakes
fist at pastebin being "under heavy load"*):

$servers = new Datastore();

$servers->newServer('ldap_pla');
$servers->setValue('server','name','LDAP');
$servers->setValue('server','host','ldap.fqdn');
$servers->setValue('server','port',389);
$servers->setValue('server','base',array('dc=fdqn,dc=com'));
$servers->setValue('login','bind_id','');
$servers->setValue('login','bind_pass','');
$servers->setValue('server','tls',false);

# SASL auth
$servers->setValue('login','auth_type','sasl');
$servers->setValue('sasl','mech','GSSAPI');
$servers->setValue('sasl','realm','REALM');
$servers->setValue('sasl','authz_id',null);
$servers->setValue('sasl','authz_id_regex','/^uid=([^,]+)(.+)/i');
$servers->setValue('sasl','authz_id_replacement','$1');
$servers->setValue('sasl','props',null);

$servers->setValue('appearance','password_hash','md5');
$servers->setValue('login','attr','dn');
$servers->setValue('login','fallback_dn',false);
#$servers->setValue('login','class',null);
$servers->setValue('server','read_only',false);
$servers->setValue('appearance','show_create',true);

$servers->setValue('auto_number','enable',true);
$servers->setValue('auto_number','mechanism','search');
$servers->setValue('auto_number','search_base',null);
$servers->setValue('auto_number','min',array('uidNumber'=>1000,'gidNumber'=>500));
$servers->setValue('auto_number','dn',null);
$servers->setValue('auto_number','pass',null);

$servers->setValue('login','anon_bind',false);
$servers->setValue('custom','pages_prefix','custom_');
$servers->setValue('unique','attrs',array('mail','uid','uidNumber'));
$servers->setValue('unique','dn',null);
$servers->setValue('unique','pass',null);

$servers->setValue('server','visible',true);
$servers->setValue('login','timeout',30);
$servers->setValue('server','branch_rename',false);
$servers->setValue('server','custom_sys_attrs',array('passwordExpirationTime','passwordAllowChangeTime'));
$servers->setValue('server','custom_attrs',array('nsRoleDN','nsRole','nsAccountLock'));
#$servers->setValue('force_may','attrs',array('uidNumber','gidNumber','sambaSID'));

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2011-06-20 20:49

Message:
The config.php.example is wrong - see patch #446faf7 which shows the
correct settings.

----------------------------------------------------------------------

Comment By: Despot (malibee)
Date: 2011-06-20 20:09

Message:
Hi wurley, thanks for the update. The good news is I don't get that error
message anymore. The bad news is I get one very much like it:

Function error called incorrectly [ERROR: Setting a index
[server,sasl_mech] that isnt predefined.]

Here's the relevant section of my config file:

$servers->setValue('login','auth_type','sasl');
$servers->setValue('server','sasl_mech','GSSAPI');
$servers->setValue('server','sasl_realm','KERBEROS.REALM');
$servers->setValue('server','sasl_authz_id',null);
$servers->setValue('server','sasl_authz_id_regex','/^uid=([^,]+)(.+)/i');
$servers->setValue('server','sasl_authz_id_replacement','$1');
$servers->setValue('server','sasl_props',null);

This is with git rev #afa4a9. I did a find / -type d -name 'phpldapadmin'
to make sure there wasn't another copy of phpldapadmin lurking about. Seems
the issue is still at large. :/

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2011-06-20 03:43

Message:
Please see Git patch #afa4a9 that hopefully fixes SASL/GSSAPI
authentication with PLA.

Let me know if it doesnt work for you.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3317146&group_id=61828

------------------------------------------------------------------------------
EditLive Enterprise is the world's most technically advanced content
authoring tool. Experience the power of Track Changes, Inline Image
Editing and ensure content is compliant with Accessibility Checking.
http://p.sf.net/sfu/ephox-dev2dev
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/