Re: external authentication source

[Hallvard Breien Furuseth <h.b.furuseth@usit.uio.no>]

On 12. mars 2015 13:03, Dieter Klünter wrote:
> rfc-4422 describes an EXTERNAL mechanism. Is there any means of
> defining and configuring an external authentication and authorization
> source, like an external sasl server? Or is this just confined to the
> client to provide an appropriate authorization string?

EXTERNAL means the credentials are passed in another layer than SASL (or
LDAP): A TLS client certificate, or with ldapi:// (Unix domain sockets)
some OSes including Linux can get the user/group ID from the socket.
Try "ldapwhoami -H ldapi://".

What you describe sounds to me more like stuff like Kerberos tickets.
These are passed inside a SASL mechanism (GSSAPI), after SASL on
the server side is configured to check them against a Kerberos server.

--
Hallvard