Quick question: has anyone been able to get slapd to work with
gssproxy on RHEL7.2?
I added this to /etc/gssproxy/gssproxy.conf:
[service/ldap]
mechs = krb5
cred_store = keytab:/etc/krb5.keytab
cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
euid = 55
krb5_principal = ldap
I then created the ldap service principal, and added this to
/etc/sysconfig/slapd:
# Tell GSSAPI to use the gssproxy interposer to broker access to
# service principals.
USE_GSS_PROXY=1
I then restarted slapd.
I can see in /proc/PID/maps that /usr/lib64/gssproxy/proxymech.so is
loaded, and if I strace the process, it *seems* like it's using the
interposer code:
32153 newfstatat(17, "gssproxy.conf", {st_mode=S_IFREG|0644,
st_size=189, ...}, 0) = 0
32153 getdents(17, /* 0 entries */, 32768) = 0
32153 close(17) = 0
32153 lstat("/etc/gss/mech.d/gssproxy.conf", {st_mode=S_IFREG|0644,
st_size=189, ...}) = 0
32153 open("/etc/gss/mech.d/gssproxy.conf", O_RDONLY) = 17
32153 fstat(17, {st_mode=S_IFREG|0644, st_size=189, ...}) = 0
32153 mmap(NULL, 4096, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc682964000
32153 read(17, "# GSS-API mechanism plugins\n#\n# "..., 4096) = 189
32153 read(17, "", 4096) = 0
32153 close(17) = 0
32153 munmap(0x7fc682964000, 4096) = 0
32153 stat("/usr/lib64/gssproxy/proxymech.so", {st_mode=S_IFREG|0755,
st_size=104512, ...}) = 0
32153 open("/usr/lib64/gssproxy/proxymech.so", O_RDONLY|O_CLOEXEC) = 17
But if I strace gssproxy at the same time, it never receives a
request. And then a little later in the slapd strace I see:
32153 open("/etc/krb5.keytab", O_RDONLY) = -1 EACCES (Permission denied)
…because slapd is running as the ldap user, and can't read
/etc/krb5.keytab.
The error message thrown back to a client is, as expected, permission
denied:
ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80)
additional info: SASL(-1): generic failure: GSSAPI Error:
Unspecified GSS failure. Minor code may provide more information
(Permission denied)
I hopped onto #gssproxy and someone suggested:
<ab> qralston: it depends on what modules you are using in slapd configuration
<ab> for example, passwd module does support kerberos but does it with
direct use of Kerberos API
<ab> libldap does implement GSSAPI authentication without sasl
<ab> kinit module (contrib/slapd-modules/kinit) also uses direct Kerberos API
But the only additional module we're loading is back_sql.
So, to repeat: has anyone managed to get this to work? If so, how did
you configure slapd?
