[Date Prev][Date Next] [Chronological] [Thread] [Top]

RE: authz-regexp behavior with GSSAPI



Dan,

Here are version details:   
openldap 2.4-39
RHEL 6.5
cyrus-sasl and cyrus-sasl-gssapi 2.1.23-15
krb5-libs   1.10.3-42

The tests I'm running (ldapclient) are on the same system as is slapd.

It appears that cross-realm authentication is problematic.  
In the following results, "success" means that the search specified by the regex occurred and the identity was remapped.  Both commands used GSSAPI (-Y for ldapwhoami, -M for slapauth):

krb5.conf default  TEST.NET.ISC.UPENN.EDU

ldapwhoami   -R TEST.NET...       success
ldapwhomai   no -R                    success
slapauth        -R TEST.NET...        success
slapauth        no realm                fail

krb5.conf default UPENN.EDU

ldapwhoami   -R TEST.NET...        fail
ldapwhoami   no realm                fail
slapauth        -R TEST.NET...          success  
slapauth        no realm specified  fail

so:
  slapauth appears to work if a realm is explicitly specified with -R  (either cross-realm or within realm), but won't remap if the realm isn't specified.
  ldapwhoami (and ldapsearch)  works within a realm whether or not the realm is specified with -R;  but won't remap if -R specifies a different realm.

Here's output from slapauth that shows the different behavior when the realm is specified or not.  Note that in this case, the

]$ sudo slapauth -d 4 -M GSSAPI -R TEST.NET.ISC.UPENN.EDU netmon
55e45abb mdb_db_open: "dc=upenn,dc=edu"
55e45abb slap_sasl_getdn: conn 18446744073709551615 id=netmon [len=6]
55e45abb [rw] authid: "uid=netmon,cn=test.net.isc.upenn.edu,cn=gssapi,cn=auth" -> "ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}netmon@TEST.NET.ISC.UPENN.EDU)"
55e45abb mdb_idl_fetch_key: [b49d1940]
55e45abb mdb_idl_fetch_key: [4f7f6931]
55e45abb send_ldap_result: err=0 matched="" text=""
ID: <netmon> check succeeded
authcID:     <uid=netmon,ou=entities,dc=upenn,dc=edu>

$ sudo slapauth -d 4 -M GSSAPI netmon
55e45ac6 mdb_db_open: "dc=upenn,dc=edu"
55e45ac6 slap_sasl_getdn: conn 18446744073709551615 id=netmon [len=6]
55e45ac6 [rw] authid: "uid=netmon,cn=gssapi,cn=auth" -> "uid=netmon,cn=gssapi,cn=auth"
ID: <netmon> check succeeded
authcID:     <uid=netmon,cn=gssapi,cn=auth>


Peter
________________________________________
From: Dan White [dwhite@olp.net]
Sent: Sunday, August 30, 2015 10:09 AM
To: Peter Heinemann
Cc: openldap-technical@openldap.org
Subject: Re: authz-regexp behavior with GSSAPI

On 08/26/15 12:51 +0000, Peter Heinemann wrote:
>I am trying to figure out different behaviors with authz-regexp in slapd.conf.

>In production is:
>
>sasl-host pennid.upenn.edu
>sasl-realm  UPENN.EDU
>authz-regexp uid=(.*),cn=UPENN.EDU,cn=gssapi,cn=auth
>        ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@UPENN.EDU)
>
>and the authentication mapping works as desired;  the user@realm gets mapped to the just the username and the search succeeds:
>
> ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid.upenn.edu
>SASL/GSSAPI authentication started
>SASL username: netmon@UPENN.EDU
>SASL SSF: 56
>SASL data security layer installed.
>dn:uid=netmon,ou=entities,dc=upenn,dc=edu
>
>However, on development in a different kerberos realm, that statement will not map properly.  The mapping doesn't take place, so user@realm is used for the (unsuccessful) search:
>
>sasl-host pennid-dev.net.isc.upenn.edu
>sasl-realm TEST.NET.ISC.UPENN.EDU
>authz-regexp  uid=(.*),cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth
>          ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU)
>
>no mapping takes place:
>
>ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu
>SASL/GSSAPI authentication started
>SASL username: netmon@TEST.NET.ISC.UPENN.EDU
>SASL SSF: 56
>SASL data security layer installed.
>dn:uid=netmon@test.net.isc.upenn.edu,cn=test.net.isc.upenn.edu,cn=gssapi,cn=auth
>
>However, a change to the regexp on the development system will cause mapping to work there:
>
>authz-regexp  uid=(.*)@TEST.NET.ISC.UPENN.EDU,cn=TEST.NET.ISC.UPENN.EDU,cn=gssapi,cn=auth
>          ldap:///ou=entities,dc=upenn,dc=edu??one?(userPassword={SASL}$1@TEST.NET.ISC.UPENN.EDU)
>
>$ ldapwhoami -Y GSSAPI -U netmon -H ldaps://pennid-dev.net.isc.upenn.edu
>SASL/GSSAPI authentication started
>SASL username: netmon@TEST.NET.ISC.UPENN.EDU
>SASL SSF: 56
>SASL data security layer installed.
>dn:uid=netmon,ou=entities,dc=upenn,dc=edu
>
>But a similar regexp in production will not map properly:
>
>Can anyone shed light on the different behavior?
>-   only the authz-regexp has been modified
>-   slapd was restarted after the changes.

Any differences in your /etc/krb5.conf? What is your default realm? Any
differences in the libraries you're using (cyrus-sasl and kerberos)?

--
Dan White <dwhite@olp.net>