Re: Kerberos with LDAP backend: password sync

[Dan White <dwhite@olp.net>]

On 22/07/11Â21:03Â+0300, Nick Milas wrote:
> On 21/7/2011 10:23 ÎÎ, Dan White wrote:
>
> > A simpler approach, and one that works with non-SASL binds, would be to
> > configure pass-through authentication and perform saslauthd/kerberos5
> > authentication. As users change their passwords (against your kerberos
> > server, via some unspecified process), you could replace their 
> > userPassword
> > entries with {SASL}user@realm (as described in the Admin guide) and 
> > do away
> > with hashed password entries altogether.
>
> If I follow this model, according to the documentation:
>
>   "Where an entry has a "{SASL}" password value, OpenLDAP delegates
>   the whole process of validating that entry's password to Cyrus SASL."
>
> Supposing that we configure SASL to use Kerberos5 authentication, 
> will our current standard applications (Postfix, Dovecot, Shibboleth, 
> Apache etc.) need to be configured to include GSSAPI SASL method?

No. However if Postfix, or other daemons which link against cyrus sasl,
happens to be using saslauthd to authenticate users, then changing
saslauthd to use the kerberos5 backend will affect how those daemons
authenticate users as well. If that's the case, you could run two saslauthd
daemons, each with their own backend, which will require a custom
saslauthd_path configuration in one of your sasl .conf files.

If your intention is to eventually authenticate directly to slapd/postfix
using SASL GSSAPI binds (rather than simple pass-through binds),
then you can 'turn on' GSSAPI piecemeal wise in each of your daemons (with
your mech_list config).

> As an example, Postfix uses Dovecot SASL to authenticate clients 
> (PLAIN method), and is configured to check their identity/password 
> against LDAP (User+Password - No SSL here because it's running on the 
> local box). I guess Postfix will need to include GSSAPI to SASL 
> methods ?

Since your Postfix is compiled again Dovecot, any changes made to saslauthd
should not affect Postfix. The fact that Postfix uses Dovecot to
authenticate, against OpenLDAP, which in turn potentially authenticates
against saslauthd/kerbero5 should all be transparent to Postfix and
Dovecot.

> In effect: Authentication for a user (hosted in LDAP) will fail in an 
> application which (uses LDAP for user/password backend and) is not 
> SASL-enabled or it is SASL-enabled but does not include/support the 
> GSSAPI method, if the user has a "{SASL}user@realm" userPassword 
> attribute value?

pass-through authentication only works with non-sasl binds. Any process
which authenticates to your slapd server via this method should be ignorant
of the fact that sasl is ultimately being used on the backend, and does not
need to support SASL itself.

If you have a client authenticating against slapd/postfix using SASL GSSAPI
binds, the userPassword entry is ignored.

--
Dan White