Re: Authenticate to ldap using Kerberos

[masarati@aero.polimi.it]

> You are directing your unhappiness at the wrong place, as Howard already
> noted.  As someone who set up a large OpenLDAP directory service that only
> allows SASL/GSSAPI connections, the issue is not OpenLDAP.  The problem is
> client software that, even though SASL has been a standard for many, many
> years, still fail to properly support it.  This includes things like
> Evolution and Postfix.  I used to maintain a patch for Postfix
> specifically
> that allowed it to do SASL/GSSAPI binds.
>
> In sum, SASL is the RFC supported mechanism to use for doing these types
> of
> binds to LDAP.  It has been the RFC supported method for a very, very long
> time.  Unfortunately, people who write LDAP client software often skip
> implementing SASL support.  This is not the fault of the OpenLDAP or any
> other directory project.  If you have client software that doesn't support
> SASL that implements LDAP v3 support, then you need to contact the authors
> of that software or fix it yourself.

Quanah, I know that in the past you, Howard and others have contributed
pieces of software to other LDAP-enabled software to enable SASL auth.

I had myself some bad experience in contributing things to software
maintainers that did not even understand the need or the importance of
what I was trying to contribute, but that's another story.

Maybe we could try, as the OpenLDAP project rather than as individuals, to
promote and support better LDAP (not just OpenLDAP) integration in other
generally useful FLOSS that can interact with OpenLDAP.

p.