git: c9cb19ffa821 - main - net/389-ds-base: build against MIT Kerberos; fix GSSAPI SASL on FreeBSD

The branch main has been updated by joneum:

URL: https://cgit.FreeBSD.org/ports/commit/?id=c9cb19ffa821e6962c5daa17c04e0bba88adfca5

commit c9cb19ffa821e6962c5daa17c04e0bba88adfca5
Author:     Jochen Neumeister <[email protected]>
AuthorDate: 2026-08-13 07:10:48 +0000
Commit:     Jochen Neumeister <[email protected]>
CommitDate: 2026-08-13 08:58:48 +0000

    net/389-ds-base: build against MIT Kerberos; fix GSSAPI SASL on FreeBSD
    
    Add USES=gssapi:mit so ns-slapd links the ports MIT Kerberos
    (security/krb5) used by the rest of the FreeIPA stack, plus two
    FreeBSD-specific fixes so GSSAPI/GSS-SPNEGO binds work:
    
    - ldaputil.c: locate the SASL plugins under ${LOCALBASE}/lib/sasl2 on
      FreeBSD (upstream only handles the Linux path).
    - saslbind.c: register the GSSAPI acceptor keytab explicitly via
      krb5_gss_register_acceptor_identity().  ns-slapd starts as root and
      then drops privileges, so issetugid() is true and MIT Kerberos ignores
      KRB5_KTNAME; without this every GSSAPI bind fails with a permission
      error on the default keytab.
    
    Sponsored by:   Netzkommune GmbH
---
 net/389-ds-base/Makefile                           |  6 +--
 .../files/patch-ldap_servers_slapd_ldaputil.c      | 13 ++++++
 .../files/patch-ldap_servers_slapd_saslbind.c      | 48 ++++++++++++++++++++++
 3 files changed, 64 insertions(+), 3 deletions(-)

diff --git a/net/389-ds-base/Makefile b/net/389-ds-base/Makefile
index 24edc1d2edfa..c88440533b24 100644
--- a/net/389-ds-base/Makefile
+++ b/net/389-ds-base/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	389-ds-base
 DISTVERSION=	3.2.1
-PORTREVISION=	3
+PORTREVISION=	4
 CATEGORIES=	net
 MASTER_SITES=	https://github.com/389ds/389-ds-base/releases/download/${PORTNAME}-${DISTVERSION}/
 
@@ -29,8 +29,8 @@ LIB_DEPENDS=	libcrack.so:security/cracklib \
 		libpkg.so:ports-mgmt/pkg \
 		libsasl2.so:security/cyrus-sasl2
 
-USES=		autoreconf gmake ldap libtool localbase:ldflags perl5 pkgconfig \
-		python:3.12+ shebangfix ssl tar:bzip2
+USES=		autoreconf gmake gssapi:mit ldap libtool localbase:ldflags \
+		perl5 pkgconfig python:3.12+ shebangfix ssl tar:bzip2
 
 USE_LDCONFIG=	${PREFIX}/lib ${PREFIX}/lib/dirsrv
 USE_PERL5=	run
diff --git a/net/389-ds-base/files/patch-ldap_servers_slapd_ldaputil.c b/net/389-ds-base/files/patch-ldap_servers_slapd_ldaputil.c
new file mode 100644
index 000000000000..f31bb93117af
--- /dev/null
+++ b/net/389-ds-base/files/patch-ldap_servers_slapd_ldaputil.c
@@ -0,0 +1,13 @@
+--- ldap/servers/slapd/ldaputil.c.orig	2026-08-10 21:10:32 UTC
++++ ldap/servers/slapd/ldaputil.c
+@@ -849,7 +849,9 @@ ldaputil_get_saslpath()
+ {
+     char *saslpath = getenv("SASL_PATH");
+     if (NULL == saslpath) {
+-#if defined(LINUX) && defined(__LP64__)
++#if defined(__FreeBSD__)
++        saslpath = "/usr/local/lib/sasl2";
++#elif defined(LINUX) && defined(__LP64__)
+         saslpath = "/usr/lib64/sasl2";
+         if (PR_SUCCESS != PR_Access(saslpath, PR_ACCESS_EXISTS)) {
+ #ifdef CPU_arm
diff --git a/net/389-ds-base/files/patch-ldap_servers_slapd_saslbind.c b/net/389-ds-base/files/patch-ldap_servers_slapd_saslbind.c
new file mode 100644
index 000000000000..3c811735acfd
--- /dev/null
+++ b/net/389-ds-base/files/patch-ldap_servers_slapd_saslbind.c
@@ -0,0 +1,48 @@
+--- ldap/servers/slapd/saslbind.c.orig	2026-04-30 12:45:04 UTC
++++ ldap/servers/slapd/saslbind.c
+@@ -23,6 +23,7 @@
+ #include <sasl/sasl.h>
+ #include <sasl/saslplug.h>
+ #include <unistd.h>
++#include <dlfcn.h>
+ 
+ static char *serverfqdn;
+ 
+@@ -684,6 +685,37 @@ ids_sasl_init(void)
+     if (result != SASL_OK) {
+         slapi_log_err(SLAPI_LOG_CONNS, "ids_sasl_init", "Failed to initialize sasl library\n");
+         return result;
++    }
++
++    /*
++     * On platforms where ns-slapd drops privileges within the process (e.g.
++     * FreeBSD, where it starts as root to bind the LDAP port and then switches
++     * to the unprivileged server user), issetugid() becomes true and MIT
++     * Kerberos refuses to honour the KRB5_KTNAME environment variable.  The
++     * GSSAPI acceptor then falls back to the default keytab (/etc/krb5.keytab),
++     * which lacks the ldap/ service key and is not readable by the server user,
++     * so every GSSAPI/GSS-SPNEGO bind fails with "No credentials ...
++     * (Permission denied)".  Register the acceptor keytab explicitly through
++     * the MIT krb5 GSSAPI extension: this is process-local (no global side
++     * effects) and is not gated by the secure-mode check.
++     */
++    {
++        const char *ktname = getenv("KRB5_KTNAME");
++        if (ktname != NULL && *ktname != '\0') {
++            void *gssh = dlopen("libgssapi_krb5.so.2", RTLD_NOW | RTLD_GLOBAL);
++            if (gssh != NULL) {
++                void (*reg_acceptor)(const char *) =
++                    (void (*)(const char *))dlsym(
++                        gssh, "krb5_gss_register_acceptor_identity");
++                if (reg_acceptor != NULL) {
++                    reg_acceptor(ktname);
++                    slapi_log_err(SLAPI_LOG_CONNS, "ids_sasl_init",
++                                  "registered GSSAPI acceptor keytab %s\n",
++                                  ktname);
++                }
++                /* keep gssh open so the registration remains valid */
++            }
++        }
+     }
+ 
+     result = sasl_auxprop_add_plugin("iDS", ids_auxprop_plug_init);