man > Authen::SASL::Perl::GSSAPI

man perldoc info pydoc3 ri search

🏷️ NAME

Authen::SASL::Perl::GSSAPI - GSSAPI (Kerberosv5) Authentication class

🚀 Quick Reference

Use Case	Command	Description
Initialize SASL with GSSAPI	use Authen::SASL qw(Perl); $sasl = Authen::SASL->new(mechanism => 'GSSAPI');	Create a SASL client object for GSSAPI (Kerberos) authentication
Authenticate to LDAP	$ldap->bind(sasl => $sasl);	Bind to an LDAP server using GSSAPI SASL authentication
Start client with service/host	$sasl->client_start($service, $host);	Initiate GSSAPI authentication to a specific service@host

📋 SYNOPSIS

use Authen::SASL qw(Perl);

$sasl = Authen::SASL->new( mechanism => 'GSSAPI' );

$sasl = Authen::SASL->new( mechanism => 'GSSAPI',
                           callback => { pass => $mycred });

$sasl->client_start( $service, $host );

📖 DESCRIPTION

This method implements the client part of the GSSAPI SASL algorithm, as described in RFC 2222 section 7.2.1 resp. draft-ietf-sasl-gssapi-XX.txt.

With a valid Kerberos 5 credentials cache (aka TGT) it allows to connect to service@host given as the first two parameters to Authen::SASL's client_start() method. Alternatively, a GSSAPI::Cred object can be passed in via the Authen::SASL callback hash using the `pass' key.

Please note that this module does not currently implement a SASL security layer following authentication. Unless the connection is protected by other means, such as TLS, it will be vulnerable to man-in-the-middle attacks. If security layers are required, then the Authen::SASL::XS GSSAPI module should be used instead.

📞 CALLBACK

The callbacks used are:

• authname — The authorization identity to be used in SASL exchange
• gssmech — The GSS mechanism to be used in the connection
• pass — The GSS credentials to be used in the connection (optional)

📝 EXAMPLE

#! /usr/bin/perl -w

use strict;

use Net::LDAP 0.33;
use Authen::SASL 2.10;

# -------- Adjust to your environment --------
my $adhost      = 'theserver.bla.net';
my $ldap_base   = 'dc=bla,dc=net';
my $ldap_filter = '(&(sAMAccountName=BLAAGROL))';

my $sasl = Authen::SASL->new(mechanism => 'GSSAPI');
my $ldap;

eval {
    $ldap = Net::LDAP->new($adhost,
                            'die')
      or  die "Cannot connect to LDAP host '$adhost': '$@'";
    $ldap->bind(sasl => $sasl);
};

if ($@) {
    chomp $@;
    die   "\nBind error         : $@",
          "\nDetailed SASL error: ", $sasl->error,
          "\nTerminated";
}

print "\nLDAP bind() succeeded, working in authenticated state";

my $mesg = $ldap->search(base   => $ldap_base,
                         filter => $ldap_filter);

# -------- evaluate $mesg

🔧 PROPERTIES

The properties used are:

• maxbuf — The maximum buffer size for receiving cipher text
• minssf — The minimum SSF value that should be provided by the SASL security layer. The default is 0
• maxssf — The maximum SSF value that should be provided by the SASL security layer. The default is 2**31
• externalssf — The SSF value provided by an underlying external security layer. The default is 0
• ssf — The actual SSF value provided by the SASL security layer after the SASL authentication phase has been completed. This value is read-only and set by the implementation after the SASL authentication phase has been completed.
• maxout — The maximum plaintext buffer size for sending data to the peer. This value is set by the implementation after the SASL authentication phase has been completed and a SASL security layer is in effect.

🔗 SEE ALSO

Authen::SASL, Authen::SASL::Perl

👥 AUTHORS

Written by Simon Wilkinson, with patches and extensions by Achim Grolms and Peter Marschall.

Please report any bugs, or post any suggestions, to the perl-ldap mailing list <perl-ldap AT perl.org>

©️ COPYRIGHT

Copyright (c) 2006 Simon Wilkinson, Achim Grolms and Peter Marschall. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

🏷️ NAME 🚀 Quick Reference 📋 SYNOPSIS 📖 DESCRIPTION 📝 EXAMPLE 🔗 SEE ALSO 👥 AUTHORS ©️ COPYRIGHT