Cyrus-sasl broken in Opensuse 12.3 and 13.1

English Applications
1

I’d like to use openldap clients like ldapsearch with gssapi authentication against AD, but cyrus-sasl 2.1.25 is broken when using ldaps. Version 2.1.21 works and I have noticed that fedora 20 with 2.1.26 works again.

This following example authenticates the user and encrypts the traffic via the gssapi ( This works)

ldapsearch -H ldap://w2k3r2.win2003r2.home -Omaxssf=56 -s sub -b DC=WIN2003R2,DC=HOME “(samaccountname=mm)”

This should authenticate the user but not encrypt the traffic (This fails) :frowning:

ldapsearch -H ldap://w2k3r2.win2003r2.home -Omaxssf=0 -s sub -b DC=WIN2003R2,DC=HOME “(samaccountname=mm)”

SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error: A required input parameter could not be read (Unknown error)

This should authenticate the user with gssapi but encrypt the traffic with SSL (This fails) :frowning:

ldapsearch -H ldaps://w2k3r2.win2003r2.home -Omaxssf=0 -s sub -b DC=WIN2003R2,DC=HOME “(samaccountname=mm)”

SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error: A required input parameter could not be read (Unknown error)

This should authenticate the user with gssapi but encrypt the traffic with SSL (This fails):frowning:

ldapsearch -H ldaps://w2k3r2.win2003r2.home -Omaxssf=56 -s sub -b DC=WIN2003R2,DC=HOME “(samaccountname=mm)”

SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error: A required input parameter could not be read (Unknown error)

Applying the “fix” from Bug 3480 (https://bugzilla.cyrusimap.org/show_bug.cgi?id=3480) make all 4 cases work, but I doubt it is the right think to do.

Can this be fixed in 12.3 and 13.1 please ? Otherwise I need to abandon OpenSuse which I used for many years now.:’(

Thank you
Markus

2

Sorry, I personaly can not help you (no ldap knowledge), but I want to point you to a feature on these forums that are very hidden (thus you did not found it until now), but very important in posting computer text. Important in that is clearly makes boundaries between “story telling” and “computer facts”, that it keeps all the layout (columns, etc.) in computer output and more niceties. These are the so called CODE tags.

You get the CODE tags by clicking on the # button in the tool bar of the post editor. Then please copy/paste the complete text from your terminal in between them. Preferably the prompt, the command, the output and the next prompt in one sweep.

Example:

henk@boven:~> ls -ld /
drwxr-xr-x 23 root root 4096 26 mrt 08:38 /
henk@boven:~>