LDAP issue with SASL 2.1.26

To: "openldap-technical@openldap.org" <openldap-technical@openldap.org>

Subject: LDAP issue with SASL 2.1.26

From: Sergey Emantayev <sergeem@yahoo.com>

Date: Wed, 4 Dec 2013 00:13:25 -0800 (PST)

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1386144805; bh=aG26dc69uJsSOp16DFDcdl60kOiVcMJ53VLrDrNVjLg=; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=wIk0Ejf9aJFnyBEwHFffrGAlBmTbORuN+mw/1W8CoNmqx5oSDQoZCYRb4QfNVyu0epbSyymjS3EkS2sKQTNdksbtCnNxRu0NZ8JqkJ75vkJAOw/m5kYwCPtnraj28LVndzsML/ia5d2htZsHVXkZQYFLpRDhbxR3SAXBYlCNLmM=

Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=oWcr+oAXV820f0RLOFlCNw8EjpbmfpTLO3UPgZ0KFDTLONiX3Fd78ip8bOpT+g/vF1IwbXxv+D3isH3RP0FyfcDdaqVkuAwvtapz8cM4XQHgEuULUE/Pk+QyS5xaDAKTTY3YK09uq30NEWJh577VorbCETuXU9fXOKV7ha4aKHI=;

Hello,

We successfully use OpenLDAP C SDK 2.4.36 integrated with Cyrus-SASL 2.1.23. Recently we have upgraded Cyrus-SASL to 2.1.26 and encountering the next issue.

LDAP search consistently fails. We analyzed this issue and found the following behavior.

When we use OpenLDAP with Cyrus-SASL 2.1.23 the LDAP Message Search Request payload is wrapped in GSS-API payload.

When we use OpenLDAP with Cyrus-SASL 2.1.26 the LDAP Message Search Request payload is not wrapped in GSS-API payload at all. LDAP Search Request looks like clear text LDAP Search Request and not like LDAP SASL Search Request.

In both cases - with Cyrus-SASL 2.1.23 and with Cyrus-SASL 2.1.26 â LDAP SASL Bind succeeds and LDAP SASL bindResponse looks identical with Cyrus-SASL 2.1.23 and with Cyrus-SASL 2.1.26.

On the SASL support mail list I was suggested to setup minssf parameter. We have double checked that it's set correctly (=1).

Please advise how to troubleshoot the issue.

Thanks & Regards,

Sergey