On Thu, Jun 24, 2010 at 12:52:32PM +0400, Alexander Gordeev wrote:
В Thu, 24 Jun 2010 09:48:16 +0200
Sumit Bose <sbose(a)redhat.com> пишет:
> On Thu, Jun 24, 2010 at 02:43:49AM +0400, Alexander Gordeev wrote:
> > В Wed, 23 Jun 2010 20:57:10 +0400
> > Alexander Gordeev <lasaine(a)lvk.cs.msu.su> пишет:
> >
> > > On Wed, 23 Jun 2010 16:33:17 +0200
> > > Sumit Bose <sbose(a)redhat.com> wrote:
> > >
> > > > This message is generated if there is not matching SASL mech entry
> > > > ('gssapi' in your case) in the
'supportedSASLMechanisms' of the
> > > > rootdse. Can you check if your client can read the rootdse and if
> > > > you can find the gssapi entry there?
> > >
> > > Thanks, I think I've found out what's going on!
> > >
> > [snip]
> > >
> > > I've looked at the code and found that sssd doesn't add any
explicit
> > > attribute requests indeed, so I made a quick patch, which I'll post
in
> > > reply to this letter. Please note that I haven't tested it yet, will
> > > do that later.
> >
> > I've just tested the patch and it works. I only had to add const
> > qualifier to eliminate warning. But while getting supported SASL
> > mechanisms works good now I'm stuck with the next issue: GSSAPI auth
> > fails. Here is the log:
> >
> > (Wed Jun 23 22:56:00 2010) [sssd[be[GNET]]] [sasl_bind_send] (4): Executing
sasl bind mech: gssapi, user: host/desktopvm.gnet@GNET
> > (Wed Jun 23 22:56:00 2010) [sssd[be[GNET]]] [sasl_bind_send] (1):
ldap_sasl_bind failed (50)[Insufficient access]
>
> Can you check what happens on the server?
Sure, here is the debug log from slapd for sssd:
Jun 24 12:30:09 authvm slapd[9304]: conn=175 fd=23 ACCEPT from IP=192.168.0.153:41918
(IP=0.0.0.0:636)
Jun 24 12:30:09 authvm slapd[9304]: conn=175 fd=23 TLS established tls_ssf=128 ssf=128
Jun 24 12:30:09 authvm slapd[9304]: conn=175 op=0 SRCH base="" scope=0 deref=0
filter="(objectClass=*)"
Jun 24 12:30:09 authvm slapd[9304]: conn=175 op=0 SRCH attr=* supportedSASLMechanisms
Jun 24 12:30:09 authvm slapd[9304]: conn=175 op=0 SEARCH RESULT tag=101 err=0 nentries=1
text=
Jun 24 12:30:10 authvm slapd[9304]: conn=175 op=1 BIND dn="" method=163
Jun 24 12:30:10 authvm slapd[9304]: conn=175 op=1 RESULT tag=97 err=14 text=SASL(0):
successful result:
Jun 24 12:30:10 authvm slapd[9304]: conn=175 op=2 BIND dn="" method=163
Jun 24 12:30:10 authvm slapd[9304]: conn=175 op=2 RESULT tag=97 err=14 text=SASL(0):
successful result:
Jun 24 12:30:10 authvm slapd[9304]: conn=175 op=3 BIND dn="" method=163
Jun 24 12:30:10 authvm slapd[9304]: SASL [conn=175] Failure: Inappropriate
authentication
Jun 24 12:30:10 authvm slapd[9304]: conn=175 op=3 RESULT tag=97 err=50 text=SASL(-14):
authorization failure: Inappropriate authentication
Jun 24 12:30:10 authvm slapd[9304]: conn=175 op=4 UNBIND
Jun 24 12:30:10 authvm slapd[9304]: conn=175 fd=23 closed
And for plain ldapsearch:
Jun 24 12:48:19 authvm slapd[11332]: conn=2 fd=17 ACCEPT from IP=192.168.0.153:46597
(IP=0.0.0.0:636)
Jun 24 12:48:19 authvm slapd[11332]: conn=2 fd=17 TLS established tls_ssf=128 ssf=128
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=0 SRCH base="" scope=0 deref=0
filter="(objectClass=*)"
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=0 SRCH attr=supportedSASLMechanisms
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=0 SEARCH RESULT tag=101 err=0 nentries=1
text=
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=1 BIND dn="" method=163
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=1 RESULT tag=97 err=14 text=SASL(0):
successful result:
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=2 BIND dn="" method=163
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=2 RESULT tag=97 err=14 text=SASL(0):
successful result:
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=3 BIND dn="" method=163
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=3 BIND
authcid="host/apollo.gnet@GNET" authzid="host/apollo.gnet@GNET"
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=3 BIND
dn="uid=host/apollo.gnet,cn=gnet,cn=gssapi,cn=auth" mech=GSSAPI sasl_ssf=56
ssf=128
Your sssd.conf says:
ldap_sasl_authid = host/desktopvm.gnet@GNET
can you check if it will work with
ldap_sasl_authid = host/apollo.gnet@GNET
bye,
Sumit
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=3 RESULT tag=97 err=0
text=
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=4 SRCH base="dc=gnet" scope=2
deref=0 filter="(objectClass=*)"
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=4 SEARCH RESULT tag=101 err=0 nentries=9
text=
Jun 24 12:48:19 authvm slapd[11332]: conn=2 op=5 UNBIND
Jun 24 12:48:19 authvm slapd[11332]: conn=2 fd=17 closed
So the last step of SASL auth is failing.
--
Alexander