[SSSD] can't connect to openldap using GSSAPI

Alexander Gordeev lasaine at lvk.cs.msu.su
Wed Jun 23 16:57:10 UTC 2010


On Wed, 23 Jun 2010 16:33:17 +0200
Sumit Bose <sbose at redhat.com> wrote:

> This message is generated if there is not matching SASL mech entry
> ('gssapi' in your case) in the 'supportedSASLMechanisms' of the rootdse.
> Can you check if your client can read the rootdse and if you can find
> the gssapi entry there?

Thanks, I think I've found out what's going on!

If I try to retrieve the rootDSE using

ldapsearch -LLL -b "" -s base -x '(objectclass=*)'

I get this:

dn:
objectClass: top
objectClass: OpenLDAProotDSE

And this goes to slapd's debug log:

Jun 23 19:17:05 authvm slapd[9304]: conn=53 fd=23 ACCEPT from IP=192.168.0.13:46875 (IP=0.0.0.0:389)
Jun 23 19:17:05 authvm slapd[9304]: conn=53 op=0 BIND dn="" method=128
Jun 23 19:17:05 authvm slapd[9304]: conn=53 op=0 RESULT tag=97 err=0 text=
Jun 23 19:17:05 authvm slapd[9304]: conn=53 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
Jun 23 19:17:05 authvm slapd[9304]: conn=53 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
Jun 23 19:17:05 authvm slapd[9304]: conn=53 op=2 UNBIND
Jun 23 19:17:05 authvm slapd[9304]: conn=53 fd=23 closed

You can see that there are no attributes like supportedSASLMechanisms
in the output. This is because all the attributes of the rootDSE are
operational and not listed without an explicit request or '+'. For
example, let's get all operational attributes:

ldapsearch -LLL -b "" -s base -x '(objectclass=*)' '+'

returns:

dn:
structuralObjectClass: OpenLDAProotDSE
configContext: cn=config
namingContexts: dc=gnet
supportedControl: 2.16.840.1.113730.3.4.18
supportedControl: 2.16.840.1.113730.3.4.2
supportedControl: 1.3.6.1.4.1.4203.1.10.1
supportedControl: 1.2.840.113556.1.4.319
supportedControl: 1.2.826.0.1.3344810.2.3
supportedControl: 1.3.6.1.1.13.2
supportedControl: 1.3.6.1.1.13.1
supportedControl: 1.3.6.1.1.12
supportedExtension: 1.3.6.1.4.1.1466.20037
supportedExtension: 1.3.6.1.4.1.4203.1.11.1
supportedExtension: 1.3.6.1.4.1.4203.1.11.3
supportedExtension: 1.3.6.1.1.8
supportedFeatures: 1.3.6.1.1.14
supportedFeatures: 1.3.6.1.4.1.4203.1.5.1
supportedFeatures: 1.3.6.1.4.1.4203.1.5.2
supportedFeatures: 1.3.6.1.4.1.4203.1.5.3
supportedFeatures: 1.3.6.1.4.1.4203.1.5.4
supportedFeatures: 1.3.6.1.4.1.4203.1.5.5
supportedLDAPVersion: 3
supportedSASLMechanisms: GSSAPI
entryDN:
subschemaSubentry: cn=Subschema

and the log says:

Jun 23 19:17:11 authvm slapd[9304]: conn=54 fd=23 ACCEPT from IP=192.168.0.13:46876 (IP=0.0.0.0:389)
Jun 23 19:17:11 authvm slapd[9304]: conn=54 op=0 BIND dn="" method=128
Jun 23 19:17:11 authvm slapd[9304]: conn=54 op=0 RESULT tag=97 err=0 text=
Jun 23 19:17:11 authvm slapd[9304]: conn=54 op=1 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
Jun 23 19:17:11 authvm slapd[9304]: conn=54 op=1 SRCH attr=+
Jun 23 19:17:11 authvm slapd[9304]: conn=54 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
Jun 23 19:17:11 authvm slapd[9304]: conn=54 op=2 UNBIND
Jun 23 19:17:11 authvm slapd[9304]: conn=54 fd=23 closed

You can see that there is a new line in the log:
Jun 23 19:17:11 authvm slapd[9304]: conn=54 op=1 SRCH attr=+

Now let's look on the log that is generated when using sssd:

Jun 23 19:16:28 authvm slapd[9304]: conn=52 fd=23 ACCEPT from IP=192.168.0.13:46874 (IP=0.0.0.0:389)
Jun 23 19:16:28 authvm slapd[9304]: conn=52 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)"
Jun 23 19:16:28 authvm slapd[9304]: conn=52 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text=
Jun 23 19:16:28 authvm slapd[9304]: conn=52 op=1 UNBIND
Jun 23 19:16:28 authvm slapd[9304]: conn=52 fd=23 closed

There are no lines listing explicit attribute requests, so it's
quite expected that it doesn't return supportedSASLMechanisms. The
right request should be like this:

ldapsearch -LLL -b "" -s base -x '(objectclass=*)' supportedSASLMechanisms

it returns:

dn:
supportedSASLMechanisms: GSSAPI

I've looked at the code and found that sssd doesn't add any explicit
attribute requests indeed, so I made a quick patch, which I'll post in
reply to this letter. Please note that I haven't tested it yet, will do
that later.

-- 
  Alexander
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 489 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100623/8d3fa658/attachment.sig>


More information about the sssd-devel mailing list