Re: SASL authentication

Xu, Qiang (FXSGSC) wrote:
>> -----Original Message-----
>> From: Rich Megginson [mailto:[email protected]] On 
>> Behalf Of Rich Megginson
>> Sent: Friday, March 13, 2009 10:50 PM
>> To: Xu, Qiang (FXSGSC)
>> Subject: Re: SASL authentication
>>
>> Well, your ldap server must have assigned a keytab from your 
>> kerberos KDC.
> 
> Just think it twice and from http://docs.hp.com/en/J4269-90049/ch04s03.html, it seems a keytab file is not necessary:

Not for users/clients, but for servers/services - your LDAP server needs 
a keytab.

> =========================================================
> Service/Host Principal
> A Kerberos keytab file contains service or host principals and associated keys information. Users can choose to bind using the service or host keys. The keytab file may contain multiple principals and keys. Users may configure which service key to use. For example, the following /etc/krb5.keytab file contains two principal:
> 
> $ klist -k 
> 
>  
> Keytab name: FILE:/etc/krb5.keytab
> Principal
> --------------------------------------------
>   1 ldapux/[email protected]
>   1 host/[email protected] 
> =========================================================
> It seems to me that if the feedback from klist command is not empty, then there exists a service principal.

Yes.  There is the host principal (host/[email protected]) which 
is probably used for things like login/ssh.  I'm not sure what 
ldapux/[email protected] is used for - could be an LDAP server 
service principal, or could be the host LDAP client principal (e.g. for 
nss_ldap, pam_ldap, etc.)

Your LDAP server needs a Kerberos service principal which is specified 
in its keytab.  If you don't know, you need to ask your Kerberos and 
LDAP server administrator.

> 
> After I authenticate against the Kerberos server, I get: 
> =========================================================
> MBC113:/ <515> /tmp/dlms/kerberos/apps/klist -k
> Ticket cache: FILE:/tmp/krb5cc_0
> Default principal: [email protected]
> 
> Valid starting     Expires            Service principal
> 03/17/09 17:36:50  03/18/09 03:37:35  krbtgt/[email protected]
>         renew until 03/18/09 17:36:50
> =========================================================
> So I do have a service principal or ticket. And it has not expired, yet.

No, you have a TGT, not a service principal.

> 
> Looking back at the tutorial at http://aput.net/~jheiss/krbldap/howto.html: 
> =========================================================
> ldap_sasl_interactive_bind_s: Local error 
>         ldap/hostname service principal not set up 
>         or your Kerberos ticket is expired 
> =========================================================
> It may just mean either there is not any ticket available, or the ticket has expired. From the feedback of klist command, it looks my error is not due to this.
> 
> In short, I think the keytab file is not necessary, provided that my kinit is successful and klist does not give an empty result. Am I right?

Not exactly.

> 
> Thanks,
> Xu Qiang