RE: Openldap crashes on GSSAPI authentication

["Howard Chu" <hyc@highlandsun.com>]

> -----Original Message-----
> From: owner-openldap-software@OpenLDAP.org
> [mailto:owner-openldap-software@OpenLDAP.org]On Behalf Of Stephen Frost

> * Mitrana Cristian (cmitrana@xnet.ro) wrote:
> > >From your sldapd.conf:
> > [..]
> > # SASL Configuration
> > #sasl-realm	math.gatech.edu
> > #sasl-host	kerberos.math.gatech.edu
> >
> > why are these commented ? Shouldn't you set them right ?
>
> You don't actually need them, really.  Supposedly if you
> don't set them
> things will work.  I've found that they do work but, for example, an
> ldapwhoami returns without the cn=REALM part.  I think that's wrong,
> though others may feel differently.  It shouldn't cause slapd
> to crash,
> certainly.

I agree with you, I think it's wrong that the SASL library omits the realm.
But I've already had this argument (and lost) on the SASL mailing list. This
is the way SASL has always worked, and always will work - when the user is
authenticating into the same realm as the server's default realm, SASL strips
the realm before passing it to the server. Feel free to dredge this topic
back up again on the Cyrus-SASL mailing lists. It's not an OpenLDAP issue.

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support