I have a couple basic questions about using OpenLDAP with SSSD in a C/C++ program. Since I think SSSD uses OpenLDAP to do this already within it's service, I thought y'all would be the ones to task. Pardon my ignorance. If you know the answer in Python/native interop, that'll work to, I can translate.
1. On a domain joined machine that has any other needed configuration, how do I call and configure OpenLDAP so it will use the SSSD machine account to authenticate with the AD server? 2. As above, but how do I specify OpenLDAP to authenticate using SPNEGO?
Am Thu, Feb 08, 2024 at 11:08:52PM -0000 schrieb David L:
I have a couple basic questions about using OpenLDAP with SSSD in a C/C++ program. Since I think SSSD uses OpenLDAP to do this already within it's service, I thought y'all would be the ones to task. Pardon my ignorance. If you know the answer in Python/native interop, that'll work to, I can translate.
- On a domain joined machine that has any other needed
configuration, how do I call and configure OpenLDAP so it will use the SSSD machine account to authenticate with the AD server?
Hi,
the first step does not involve OpenLDAP, a Kerberos ticket is needed which can be requested with the help of the Kerberos keys stored typically in /etc/krb5.keytab, which is typically created during the join. What you have to do is the equivalent of
kinit -k 'CLIENT$@AD.REALM'
where 'CLIENT$@AD.REALM' is the typical AD host principal which can be found by checking the `klist -k` output and looking for a principal with a '$' before the '@'.
On the C level you can use libkrb5 or libgssapi to get the ticket, e.g. for libkrb5 the actual call doing it is `krb5_get_init_creds_keytab()`.
- As above, but how do I specify OpenLDAP to authenticate using
SPNEGO?
If you have a Kerberos ticket you can call one of OpenLDAP`s `ldap_sasl_*_bind*()` calls were you put "GSS-SPNEGO" in the `mechanism` argument.
HTH
bye, Sumit
-- _______________________________________________ sssd-devel mailing list -- sssd-devel@lists.fedorahosted.org To unsubscribe send an email to sssd-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahosted.o... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Thankyou, great, that's about what I expected. I am coming at this from a Windows perspective so I'm not as familiar with where the calls are in Linux.
I'll probably have some more questions in a week or two or three.
sssd-devel@lists.fedorahosted.org