LDAP bind using ldap_sasl_interactive_bind_s and DIGEST-MD5 fails the second time

[James Bong <jbong16@gmail.com>]

I am currently using Mac OS X 10.6.2 and am attempting to use the ldap_sasl_interactive_bind_s API to do a digest-md5 authentication against Active Directory (2008, though I don't think it matters what flavor of AD is used). The bind works fine the first time. However, if I unbind and attempt to rebind as the same user, it fails with ldap_sasl_interactive_bind_s: Invalid credentials (49). If I bind with a different user, then unbind, and bind as the original user, it works. I created a simple program that illustrates the issue. When run, it binds correctly, unbinds, and then fails on the second bind after unbinding:

trying

ldap_sasl_interactive_bind_s

callback

callback done

ldap_sasl_interactive_bind_s Done

Unbinding

Unbound.

ldap_sasl_interactive_bind_s

callback

callback done

ldap_sasl_interactive_bind_s: Invalid credentials (49)

additional info: 80090308: LdapErr: DSID-0C0904D1, comment: AcceptSecurityContext error, data 57, v1772

Any idea why it is not possible to use the same credentials twice?

Here is the test program. I tried reinitializing the sasl library with sasl_done and sasl_client_init, but that doesn't seem to make a difference.

#include <ldap.h>

#include <sasl/sasl.h>

#include <stdio.h>

typedef struct sasl_defaults {

    char *mech;

    char *realm;

    char *authcid;

    char *passwd;

    char *authzid;

} sasl_defaults;

int callback(LDAP *ld, unsigned flags, void* defaults, void *interact ) {

    printf("callback\n");

    sasl_interact_t *in_out=(sasl_interact_t *)interact;

    sasl_defaults *in_defaults=(sasl_defaults *)defaults;

    while (in_out->id !=SASL_CB_LIST_END) {

        switch (in_out->id) {

            case SASL_CB_USER: 

in_out->result=in_defaults->authcid;

in_out->len=strlen(in_defaults->authcid); 

                break;

            case SASL_CB_AUTHNAME: 

in_out->result=in_defaults->authcid;

                in_out->len=strlen(in_defaults->authcid);    

                break;

            case SASL_CB_PASS:     

in_out->result=in_defaults->passwd;

                in_out->len=strlen(in_defaults->passwd);

                break;

            case SASL_CB_GETREALM:

in_out->result="";

                in_out->len=strlen("");

                break;

        }

        in_out++;

    }

    printf("callback done\n");

    return 0; 

}

int main (int argv, char ** argc) {

    

    printf("trying\n");

    for (;;) {

        LDAP *ld;

        ldap_initialize(&ld, "ldap://dc.ad.domain.com:389");

        ldap_set_option(ld,LDAP_OPT_REFERRALS,LDAP_OPT_OFF);    

        

         int version=3;

        ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version );

        int timelimit=5;

        if (ldap_set_option( ld, LDAP_OPT_TIMELIMIT, (void *) &timelimit ) != LDAP_OPT_SUCCESS )

        {

            printf("err\n");

            return -1;

        }

        

        sasl_defaults defaults;

        defaults.mech = "DIGEST-MD5";

        defaults.passwd="password";

        defaults.authcid="user";

        defaults.realm="realm.com";

        defaults.authzid="user";

        

        printf("ldap_sasl_interactive_bind_s\n");

        int rc=ldap_sasl_interactive_bind_s( ld, NULL,defaults.mech, NULL, NULL, LDAP_SASL_QUIET, callback, &defaults );

        if( rc != LDAP_SUCCESS ) {

                    

            ldap_perror( ld, "ldap_sasl_interactive_bind_s" );

                ldap_unbind(ld);

            return -1;

        }

        printf("ldap_sasl_interactive_bind_s Done\n");

        printf("Unbinding\n");

        ldap_unbind(ld);

        printf("Unbound.\n");

        sleep(5);

    }

}