Re: How does Openldap work with Cyrus SASL and MIT Kerberos V

[Buchan Milne <bgmilne@staff.telkomsa.net>]

On Tue, 2008-07-01 at 08:41 +0700, Le Trung Kien wrote:
> As you know, on each client machine, I type "setup" and go in
> "Authentication Configuration" then fill up information about kerberos
> and ldap server.
> And so, my users could login our Kerberos&LDAP system.
> 
> after login, users must get ticket to use ldap services by emit
> command : "kinit" then type their kerberos password. After get their
> tickets, they can use ldap services.
> I have tested this with "ldapwhoami" and get the proper user
> information (which belongs to ldap).
> And I have only password on Kerberos for each user.
> If I were wrong, please show me :)
> Could you explain to me how SASL gets involved in this ?
> 

OpenLDAP does not use Kerberos directly, instead it uses SASL. If your
LDAP server has a Kerberos service principal, and has the SASL GSSAPI
plugin installed and enabled, then the OpenLDAP client utilities will
try appropriate SASL mechanisms (if the user has a ticket).

So, you are using SASL to authenticate via Kerberos your users when
accessing the LDAP service.

Regards,
Buchan