Добрые 2 недели пытаюсь связать Heimdal Kerberos и Openldap на FreeBSD 10.0.
Задача следующая - аутентификация должна проходить посредством кербероса, далее пользователь с тикетом обращается к ldap для авторизации. Т.е. все пароли храняться в керберосе, а непосредственно в ldap хранится вся база пользователей, групп и их полномочий. Хранить базу кербероса в ldap не требуется. На настоящий имеются следующие успехи:1. Heimdal kerberos из портов настроен и выдает тикеты, как локально, так и по сети.
2. Openldap с поддержкой SASL, GSSAPI собран, настроен, запускается и по учетной записи rootpw выдает информацию о базе.
3. И в керберос и в ldap добавлен пользователь admin. Который получает общий тикет у кербероса, если я правильно понимаю, получает тикет на пользование ldap, но при этом локально при попытке соединения с ldap с аутентификацией по sasl выдает ошибку.
Итак, у меня имеется 2 вопроса, первый:
При запуске slapd выдает следующую ошибку:
Код: Выделить всё
slapd[85689]: SQL engine 'mysql' not supported
slapd[85689]: auxpropfunc error no mechanism availableКод: Выделить всё
slapd[85689]: _sasl_plugin_load failed on sasl_auxprop_plug_init for plugin: sqlВторой вопрос:
Собственно данный вопрос как раз на тему связи kerberos и ldap. При выполнении локально команды
Код: Выделить всё
ldapwhoami -Y GSSAPIКод: Выделить всё
ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80)
additional info: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown) Код: Выделить всё
openldap-sasl-server-2.4.40_2
[x] ACCESSLOG With In-Directory Access Logging overlay
[ ] ACI Per-object ACI (experimental)
[x] AUDITLOG With Audit Logging overlay
[ ] BDB With BerkeleyDB backend (DEPRECATED)
[ ] COLLECT With Collect overy Services overlay
[ ] CONSTRAINT With Attribute Constraint overlay
[ ] DDS With Dynamic Directory Services overlay
[ ] DEREF With Dereference overlay
[x] DNSSRV With Dnssrv backend
[ ] DYNACL Run-time loadable ACL (experimental)
[x] DYNAMIC_BACKENDS Build dynamic backends
[ ] DYNGROUP With Dynamic Group overlay
[ ] DYNLIST With Dynamic List overlay
[ ] FETCH Enable fetch(3) support
[x] GSSAPI With GSSAPI support (implies SASL support)
[ ] LMPASSWD With LM hash password support (DEPRECATED)
[x] MDB With Memory-Mapped DB backend
[ ] MEMBEROF With Reverse Group Membership overlay
[ ] ODBC With SQL backend
[ ] PASSWD With Passwd backend
[ ] PERL With Perl backend
[x] PPOLICY With Password Policy overlay
[ ] PROXYCACHE With Proxy Cache overlay
[ ] REFINT With Referential Integrity overlay
[ ] RELAY With Relay backend
[ ] RETCODE With Return Code testing overlay
[ ] RLOOKUPS With reverse lookups of client hostnames
[ ] RWM With Rewrite/Remap overlay
[x] SASL With (Cyrus) SASL2 support
[x] SEQMOD With Sequential Modify overlay
[ ] SHA2 With SHA2 Password hashes overlay
[ ] SHELL With Shell backend (disables threading)
[ ] SLAPI With Netscape SLAPI plugin API (experimental)
[ ] SLP With SLPv2 (RFC 2608) support
[x] SMBPWD With Samba Password hashes overlay
[ ] SOCK With Sock backend
[ ] SSSVLV With ServerSideSort/VLV overlay
[x] SYNCPROV With Syncrepl Provider overlay
[x] TCP_WRAPPERS With tcp wrapper support
[ ] TRANSLUCENT With Translucent Proxy overlay
[ ] UNIQUE With attribute Uniqueness overlay
[ ] VALSORT With Value Sorting overlay Код: Выделить всё
cyrus-sasl-2.1.26_9
[ ] ALWAYSTRUE the alwaystrue password verifier
[x] AUTHDAEMOND use of authdaemon
[x] DOCS Build and/or install documentation
[ ] KEEP_DB_OPEN Keep handle to Berkeley DB open
[x] OBSOLETE_CRAM_ATTR cmusaslsecretCRAM-MD5 property
[ ] BDB Berkeley DB support
[ ] MYSQL MySQL database support
[ ] PGSQL PostgreSQL database support
MECH
[ ] CRAM CRAM-MD5 authentication
[ ] DIGEST DIGEST-MD5 authentication
[ ] LOGIN LOGIN authentication
[ ] NTLM NTLM authentication
[ ] OTP OTP authentication
[x] PLAIN PLAIN authentication
[ ] SCRAM SCRAM authentication
SQLite database support
( ) SQLITE2 SQLite 2 database
(*) SQLITE3 SQLite 3 database support Код: Выделить всё
cyrus-sasl-gssapi-2.1.26_3
( ) BASE Use Heimdal in base
(*) HEIMDAL Use Heimdal from ports
( ) MIT Use MIT Kerberos V5 Код: Выделить всё
heimdal-1.5.3_3
[x] BDB Enable BerkeleyDB KDC backend support
[x] CRACKLIB Use CrackLib for password quality checking
[x] DIGEST Enable DIGEST support
[x] IPV6 IPv6 protocol support
[x] KX509 Enable kx509 support
[x] LDAP Enable OpenLDAP KDC backend support
[x] PKINIT Enable PK-INIT support
[ ] SQLITE Enable SQLite KDC backend support
[ ] X11 Build X11 utilies /etc/krb5.conf
Код: Выделить всё
1 [libdefaults]
2 default_realm = LEN.LOCAL
3 [realms]
4 LEN.LOCAL = {
5 kdc = server.len.local
6 admin_server = server.len.local
7 kpasswd_server = server.len.local
8 }
9 [domain_realm]
10 .len.local = LEN.LOCAL
11 [logging]
12 kdc = FILE:/var/log/krb5kdc.log
13 admin_server = FILE:/var/log/kadmin.log
14 default = FILE:/var/log/krb5lib.logКод: Выделить всё
1 #
2 # See slapd.conf(5) for details on configuration options.
3 # This file should NOT be world readable.
4 #
5 include /usr/local/etc/openldap/schema/core.schema
6 include /usr/local/etc/openldap/schema/cosine.schema
7 include /usr/local/etc/openldap/schema/inetorgperson.schema
8 # include /usr/local/etc/openldap/schema/nis.schema
9
10 # Define global ACLs to disable default read access.
11
12 # Do not enable referrals until AFTER you have a working directory
13 # service AND an understanding of referrals.
14 # referral ldap://root.openldap.org
15
16 pidfile /var/run/openldap/slapd.pid
17 argsfile /var/run/openldap/slapd.args
18
19 logfile /var/log/slapd.log
20 loglevel -1
21
22 # Load dynamic backend modules:
23 modulepath /usr/local/libexec/openldap
24 moduleload back_mdb
25
26 # Sample security restrictions
27 # Require integrity protection (prevent hijacking)
28 # Require 112-bit (3DES or better) encryption for updates
29 # Require 63-bit encryption for simple bind
30 # security ssf=1 update_ssf=112 simple_bind=64
31
32 sasl-host server.len.local
33 sasl-realm LEN.LOCAL
34 # sasl-secprops minssf=0
35
36 authz-regexp
37 uid=([^,]*),cn=len.local,cn=gssapi,cn=auth
38 uid=$1,ou=people,dc=len,dc=local
39
40 # Sample access control policy:
41 # Root DSE: allow anyone to read it
42 # Subschema (sub)entry DSE: allow anyone to read it
43 # Other DSEs:
44 # Allow self write access
45 # Allow authenticated users read access
46 # Allow anonymous users to authenticate
47 # Directives needed to implement policy:
48 # access to dn.base="" by * read
49 # access to dn.base="cn=Subschema" by * read
50 # access to *
51 # by self write
52 # by users read
53 # by anonymous auth
54 #
55 # if no access controls are present, the default policy
56 # allows anyone and everyone to read anything but restricts
57 # updates to rootdn. (e.g., "access to * by * read")
58 #
59 # rootdn can always read and write EVERYTHING!
60
61 #######################################################################
62 # backend database definitions
63 #######################################################################
64
65 database mdb
66 maxsize 1073741824
67 suffix "dc=len,dc=local"
68 rootdn "cn=root,dc=len,dc=local"
69 # Cleartext passwords, especially for the rootdn, should
70 # be avoid. See slappasswd(8) and slapd.conf(5) for details.
71 # Use of strong authentication encouraged.
72 rootpw verysecret
73 # The database directory MUST exist prior to running slapd AND
74 # should only be accessible by the slapd and slap tools.
75 # Mode 700 recommended.
76 directory /var/db/openldap-data/len-local
77 # Indices to maintain
78 index uid eq
79 index cn,gn,mail eq,sub
80 index sn eq,sub
81 index ou eq
82 index ObjectClass eq
83 index default eq,sub
84 index telephonenumberКод: Выделить всё
1 #
2 # LDAP Defaults
3 #
4
5 # See ldap.conf(5) for details
6 # This file should be world readable but not world writable.
7
8 BASE dc=len,dc=local
9 HOST SERVER.len.local
10 URI ldap://server.len.local
11
12 #SIZELIMIT 12
13 #TIMELIMIT 15
14 #DEREF never
Код: Выделить всё
1 mech_list: GSSAPIКод: Выделить всё
root@SERVER:~ # klist
Credentials cache: FILE:/tmp/krb5cc_0
Principal: admin@LEN.LOCAL
Issued Expires Principal
Dec 14 15:59:11 2014 Dec 15 01:59:11 2014 krbtgt/LEN.LOCAL@LEN.LOCAL
Dec 14 15:59:41 2014 Dec 15 01:59:11 2014 ldap/server.len.local@LEN.LOCALКод: Выделить всё
root@SERVER:~ # ls -l /etc/krb5.keytab
-rw-r----- 1 root ldap 560 Dec 7 21:24 /etc/krb5.keytabКод: Выделить всё
root@SERVER:~ # ldapsearch -x -b '' -s base supportedSASLMechanisms
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: supportedSASLMechanisms
#
#
dn:
supportedSASLMechanisms: GSSAPI
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
, завтра подробно напишу, что и как, но пока что скажу - как я и подозревал, - непорядок был в конфигах, причем совершенно примитивного характера.