[phpldapadmin] [ phpldapadmin-Bugs-3317146 ] sasl auth options unsupported

Bugs item #3317146, was opened at 2011-06-16 14:52
Message generated for change (Comment added) made by wurley
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3317146&group_id=61828

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
>Status: Pending
Resolution: Fixed
Priority: 5
Private: No
Submitted By: Despot (malibee)
Assigned to: Nobody/Anonymous (nobody)
Summary: sasl auth options unsupported

Initial Comment:
- phpldadmin 1.2.1.1, direct download from Sourceforge
- OpenLDAP 2.4.21
- Apache 2.2.14
- PHP 5.3.2
- Ubuntu 10.04 (Lucid Lynx)

1. Rename config.php.example to config.php. Seems to work fine (I didn't test this extensively, but the login screen is displayed). 
2. Uncomment this line in the otherwise unmodified config.php file:

$servers->setValue('server','sasl_auth',false);

The following error results:

"Function error called incorrectly [ERROR: Setting a index [server,sasl_auth] that isnt predefined.]"

This is almost certainly a dupe of #3111146, but I don't know of a way to add myself as an affected user. The issue is show-stopper for me, so I'd like to put a bounty on it. I will donate $20 to the project once the bug is fixed.

----------------------------------------------------------------------

>Comment By: Deon George (wurley)
Date: 2011-06-22 21:32

Message:
My test environment is CentOS 5.5, openldap 2.3.43, php 5.3.6, apache
2.2.15, krb5 1.6.1.

I've also used negotiate, which worked fine (firebox 4.0.1 on ubuntu
10.04), except it was slow over a WAN link (due to each connection
negotiating a kerberous ticket - I'm sure there must be some caching that
I'm not using, or a better apache config that I could use - since it was
the icons that were probably having (unnecessary) tickets created between
the browser and server).

If there is something else that needs to be fixed in PLA, happy to do it,
since I'm sure others will benefit too. However, in your case, I think your
issue is outside of PLA...

----------------------------------------------------------------------

Comment By: Despot (malibee)
Date: 2011-06-22 17:11

Message:
Good article, thanks. The -2 error was resolved (for the moment) by using
Apache's Basic Auth mechanism instead of relying on GSSAPI SPNEGO in the
browser. Putting a pin in that, I've gotten as far as this:

slapd[1441]: conn=1378 op=0 BIND dn="" method=163
slapd[1441]: conn=1378 op=0 RESULT tag=97 err=14 text=SASL(0): successful
result: 
slapd[1441]: conn=1378 op=1 BIND dn="" method=163
slapd[1441]: conn=1378 op=1 RESULT tag=97 err=14 text=SASL(0): successful
result: 
slapd[1441]: conn=1378 op=2 BIND dn="" method=163
slapd[1441]: SASL [conn=1378] Failure: Inappropriate authentication

As a test I replaced the variable references in the call to ldap_sasl_bind
in ds_ldap.php with hardcoded, known-good values, and received the same
error. I believe this indicates that the inappropriate authentication issue
doesn't relate to PLA's configuration file specifically, and is part of a
larger issue with PLA's interface to PHP/LDAP. I'd be interested to know
what versions of PHP and OpenLDAP you're running; I have 5.3.2 and 2.4.2
respectively.

The issue seems larger and only tangentially related, so it might be time
to mark this bug closed. The bug on which I placed the bounty is fixed, so
I'm willing to pay up, although I would like very much to have my
configuration working before paying the bounty. I'll leave the pay now/pay
later decision to you.

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2011-06-21 21:27

Message:
"Local error" normally indicates that php (or rather apache) doesnt have a
TGT. If you are using mod_auth_kerb, make sure you have "KrbSaveCredentials
on".

My configuration is basically the same as this setup, which works fine:
http://left.subtree.org/2007/06/26/phpldapadmin-and-kerberos/

----------------------------------------------------------------------

Comment By: Despot (malibee)
Date: 2011-06-21 16:24

Message:
This snippet from the PLA log file seems relevant:

[0.000]              ds(0072-017): .DS::getValue: Entered (sasl|mech)
[0.000]              ds(0072-017): .DS::getValue: Entered (sasl|realm)
[0.000]              ds(0072-017): .DS::getValue: Entered (sasl|props)
[0.008]       functions(0124-001): app_error_handler: Entered
(2|ldap_sasl_bind(): Unable to bind to server: Local
error|/usr/share/phpldapadmin/lib/ds_ldap.php|664|a:4:{s:8:"resource";i:0;s:6:"method";s:4:"user";s:5:"fargs";a:2:{i:0;i:0;i:1;s:4:"user";}
[0.001]         ds_ldap(0202-016): ldap::connect: Resource [Resource id
#25], Bind Result
[a:3:{s:2:"id";s:28:"kerberosPrincipal@REALM";s:4:"pass";s:0:"";s:6:"result";b:0;}]
[0.000]         ds_ldap(0206-016): ldap::connect: Leaving with FALSE, bind
FAILed

----------------------------------------------------------------------

Comment By: Despot (malibee)
Date: 2011-06-21 16:07

Message:
Getting closer...the PLA interface comes up, but binding to the directory
fails. The slapd logs indicate the connection is made, and then immediately
dropped. I'm going to have to look into this tomorrow; it's not immediately
apparent if this is a configuration issue or a result of the bug. It looks
as if PLA is trying to bind anonymously, but I haven't figured out a way to
get PLA to print the bind DN in its debug output.

For your reading pleasure, here's the configuration I'm using (*shakes
fist at pastebin being "under heavy load"*):

$servers = new Datastore();

$servers->newServer('ldap_pla');
$servers->setValue('server','name','LDAP');
$servers->setValue('server','host','ldap.fqdn');
$servers->setValue('server','port',389);
$servers->setValue('server','base',array('dc=fdqn,dc=com'));
$servers->setValue('login','bind_id','');
$servers->setValue('login','bind_pass','');
$servers->setValue('server','tls',false);

# SASL auth
$servers->setValue('login','auth_type','sasl');
$servers->setValue('sasl','mech','GSSAPI');
$servers->setValue('sasl','realm','REALM');
$servers->setValue('sasl','authz_id',null);
$servers->setValue('sasl','authz_id_regex','/^uid=([^,]+)(.+)/i');
$servers->setValue('sasl','authz_id_replacement','$1');
$servers->setValue('sasl','props',null);

$servers->setValue('appearance','password_hash','md5');
$servers->setValue('login','attr','dn');
$servers->setValue('login','fallback_dn',false);
#$servers->setValue('login','class',null);
$servers->setValue('server','read_only',false);
$servers->setValue('appearance','show_create',true);

$servers->setValue('auto_number','enable',true);
$servers->setValue('auto_number','mechanism','search');
$servers->setValue('auto_number','search_base',null);
$servers->setValue('auto_number','min',array('uidNumber'=>1000,'gidNumber'=>500));
$servers->setValue('auto_number','dn',null);
$servers->setValue('auto_number','pass',null);

$servers->setValue('login','anon_bind',false);
$servers->setValue('custom','pages_prefix','custom_');
$servers->setValue('unique','attrs',array('mail','uid','uidNumber'));
$servers->setValue('unique','dn',null);
$servers->setValue('unique','pass',null);

$servers->setValue('server','visible',true);
$servers->setValue('login','timeout',30);
$servers->setValue('server','branch_rename',false);
$servers->setValue('server','custom_sys_attrs',array('passwordExpirationTime','passwordAllowChangeTime'));
$servers->setValue('server','custom_attrs',array('nsRoleDN','nsRole','nsAccountLock'));
#$servers->setValue('force_may','attrs',array('uidNumber','gidNumber','sambaSID'));

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2011-06-21 13:49

Message:
The config.php.example is wrong - see patch #446faf7 which shows the
correct settings.

----------------------------------------------------------------------

Comment By: Despot (malibee)
Date: 2011-06-21 13:09

Message:
Hi wurley, thanks for the update. The good news is I don't get that error
message anymore. The bad news is I get one very much like it:

Function error called incorrectly [ERROR: Setting a index
[server,sasl_mech] that isnt predefined.]

Here's the relevant section of my config file:

$servers->setValue('login','auth_type','sasl');
$servers->setValue('server','sasl_mech','GSSAPI');
$servers->setValue('server','sasl_realm','KERBEROS.REALM');
$servers->setValue('server','sasl_authz_id',null);
$servers->setValue('server','sasl_authz_id_regex','/^uid=([^,]+)(.+)/i');
$servers->setValue('server','sasl_authz_id_replacement','$1');
$servers->setValue('server','sasl_props',null);

This is with git rev #afa4a9. I did a find / -type d -name 'phpldapadmin'
to make sure there wasn't another copy of phpldapadmin lurking about. Seems
the issue is still at large. :/

----------------------------------------------------------------------

Comment By: Deon George (wurley)
Date: 2011-06-20 20:43

Message:
Please see Git patch #afa4a9 that hopefully fixes SASL/GSSAPI
authentication with PLA.

Let me know if it doesnt work for you.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=498546&aid=3317146&group_id=61828

------------------------------------------------------------------------------
Simplify data backup and recovery for your virtual environment with vRanger.
Installation's a snap, and flexible recovery options mean your data is safe,
secure and there when you need it. Data protection magic?
Nope - It's vRanger. Get your free trial download today.
http://p.sf.net/sfu/quest-sfdev2dev
______________________________________
phpLDAPadmin development mailing list.
To unsbuscribe: https://lists.sourceforge.net/lists/listinfo/phpldapadmin-devel
http://phpldapadmin.sourceforge.net/