GSSAPI not in supportedSASLMechanism

[shuva brata deb <shuvabrata@yahoo.com>]

Hi,

I am trying to configure OpenLdap 2.0.15 on HP-UX
10.20  with GSSAPI as the authentication mechanism. I
have Kerberos krb5-1.2.2 installed and it works fine,
( i mean i can use kadmin, ktadd, ktrem, kinit, klist,
kdestroy successfully). I have cyrus-sasl-1.5.27
installed and its sample client and sample server test
passes successfully selecting GSSAPI as the best
mechanism. I also have ldbm version db-4.0.14
installed. While configuring OpenLdap , when i run
make test , i donot see GSSAPI as the
supportedSASLmechanism. I get PLAIN, SIMPLE,
ANONYMOUS, CRAM-MD5 and DIGEST-MD5 as the supported
mechanisms. All tests pass successfully.    


   After installing OpenLdap i can add and remove
entries, however when i execute the following command.


%>  ldapsearch -x -s base -b ""
supportedSASLMechanisms

i get the following output.
  

-----------------------------------------------------------------------------

version: 2

#
# filter: (objectclass=*)
# requesting: supportedSASLMechanisms 
#

#
dn:
supportedSASLMechanisms: LOGIN
supportedSASLMechanisms: PLAIN
supportedSASLMechanisms: ANONYMOUS
supportedSASLMechanisms: DIGEST-MD5
supportedSASLMechanisms: CRAM-MD5

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
 
--------------------------------------------------------------------------------


I cant understand why GSSAPI is not listed as a
supportedSASLmechanism. ?


I configured OpenLdap with the following options:

%> ./configure --with-cyrus-sasl --with-kerberos
--with-tls --enable-slapd  --enable-crypt
--enable-kpasswd --enable-spasswd --enable-ldbm
--enable-cleartext --enable-debug.     


Can anybody provide some information, why GSSAPI is
missing as a mechanism for LDAP.


My ldap.conf file is as follows.

----------------------------------------------------------------------------------------
# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v
1.8.8.7 2001/09/27 20:00:31 kurt Exp $
#
# See slapd.conf(5) for details on configuration
options.
# This file should NOT be world readable.
#
include        
/usr/local/etc/openldap/schema/core.schema
include        
/usr/local/etc/openldap/schema/cosine.schema
include        
/usr/local/etc/openldap/schema/inetorgperson.schema

schemacheck    off

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a
working directory
# service AND an understanding of referrals.
#referral       ldap://root.openldap.org

pidfile         /usr/local/var/slapd.pid
argsfile        /usr/local/var/slapd.args

# Load dynamic backend modules:
# modulepath    /usr/local/libexec/openldap
# moduleload    back_ldap.la
# moduleload    back_ldbm.la
# moduleload    back_passwd.la
# moduleload    back_shell.la

#
# Sample Access Control
#       Allow read access of root DSE
#       Allow self write access
#       Allow authenticated users read access
#       Allow anonymous users to authenticate
#
access to * by * write
#access to dn="" by * read
#access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default is:
#       Allow read by all
#
# rootdn can always write!


access to *
              by * write
              by * read
              by * auth
              by self write
              by users read
              by anonymous auth


# ldbm database definitions
#######################################################################

sasl-realm          SCE.BRV.COM
sasl-host           sce.BRV.com
sasl-secprops       none

database        ldbm
#suffix         "dc=my-domain,dc=com"
suffix          "o=MYLDAP,c=US"
#rootdn         "cn=Manager,dc=my-domain,dc=com"
rootdn          "cn=root,o=MYLDAP,c=US"
#rootdn         "uid=root@MYLDAP.COM"


# Cleartext passwords, especially for the rootdn,
should
# be avoid.  See slappasswd(8) and slapd.conf(5) for
details.
# Use of strong authentication encouraged.
rootpw          secret
# The database directory MUST exist prior to running
slapd AND
# should only be accessible by the slapd/tools. Mode
700 recommended.
directory       /usr/local/var/openldap-ldbm
# Indices to maintain
index   objectClass     eq

-----------------------------------------------------------------------------------------

Regards,
Shuva.//

__________________________________________________
Do You Yahoo!?
Send FREE video emails in Yahoo! Mail!
http://promo.yahoo.com/videomail/