From owner-freebsd-stable@FreeBSD.ORG Wed Sep 1 16:51:15 2010 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 23E9E1065695 for ; Wed, 1 Sep 2010 16:51:15 +0000 (UTC) (envelope-from me@janh.de) Received: from mailhost.uni-hamburg.de (mailhost.uni-hamburg.de [134.100.32.155]) by mx1.freebsd.org (Postfix) with ESMTP id A97DD8FC1D for ; Wed, 1 Sep 2010 16:51:14 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mailhost.uni-hamburg.de (Postfix) with ESMTP id 6A008901F5; Wed, 1 Sep 2010 18:33:02 +0200 (CEST) X-Virus-Scanned: by University of Hamburg (RRZ/mailhost) Received: from mailhost.uni-hamburg.de ([127.0.0.1]) by localhost (mailhost.uni-hamburg.de [127.0.0.1]) (amavisd-new, port 10024) with LMTP id mWkixs8Ne7k5; Wed, 1 Sep 2010 18:33:02 +0200 (CEST) Received: from pc911.math.uni-hamburg.de (pc911.math.uni-hamburg.de [134.100.220.198]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) (Authenticated sender: fmjv004) by mailhost.uni-hamburg.de (Postfix) with ESMTPSA id 536F9901BF; Wed, 1 Sep 2010 18:33:02 +0200 (CEST) Message-ID: <4C7E803F.1090606@janh.de> Date: Wed, 01 Sep 2010 18:33:03 +0200 From: Jan Henrik Sylvester User-Agent: Mozilla/5.0 (X11; U; FreeBSD amd64; en-US; rv:1.9.1.11) Gecko/20100821 Thunderbird/3.0.6 MIME-Version: 1.0 To: stable-list freebsd Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: GSSAPI (for OpenLDAP) on FreeBSD 8? X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Sep 2010 16:51:15 -0000 I have got problems with GSSAPI authentication to OpenLDAP: ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) additional info: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown) There were at least two discussions, multiple bug reports, and patches about broken GSSAPI on FreeBSD 8, the longest (I found) starting here: http://lists.freebsd.org/pipermail/freebsd-stable/2010-July/057734.html After reading through these discussions, I do not know what the proper fix is -- I would like to change as little as possible introducing SASL authentication to a (production) OpenLDAP server. I have got: An i386 kerberos server, a ldap server in a jail on i386, some amd64 clients -- all running 8.1-RELEASE. Eventually there need to be some Debian/Ubuntu clients using GSSAPI/SASL, too. What do I need to "fix"? Just the ldap server? Is it enough to change the jail or does the host needs to be patches, too? Or do I need to fix the client, too? The kerberos server? From the discussion, multiple fixes were possible. Patching libgssapi and reinstalling everything depending on it (what?), installing the heimdal-1.0 port (while FreeBSD 8 comes with heimdal-1.1), installing an unofficial heimdal-1.2 port, ... Is that correct? Anything new after the discussion in July? From the discussion, some patches should already be in 8-STABLE, but I could not find the revision (after 8.1-RELEASE). If I upgraded the ldap jail to 8-STABLE, I guess the host needs to be updated, too. Hence I would prefer to just change ports or update single libraries. Does anyone have OpenLDAP+GSSAPI running on FreeBSD 8? With the libgssapi patch? With the heimdal-1.2 port? Thanks, Jan Henrik