# perldoc > Authen::SASL::Perl::GSSAPI

---
type: CommandReference
command: Authen::SASL::Perl::GSSAPI
mode: perldoc
section: 
source: perldoc
---

## Quick Reference

- `Authen::SASL->new(mechanism => 'GSSAPI')` — create a GSSAPI SASL client object
- `$sasl->client_start($service, $host)` — initiate authentication to *service*@*host*
- `$sasl->error` — retrieve detailed SASL error message
- `$ldap->bind(sasl => $sasl)` — use with Net::LDAP for authenticated bind
- `Authen::SASL->new(mechanism => 'GSSAPI', callback => { pass => $cred })` — pass a GSSAPI::Cred object as credentials

## Name

Authen::SASL::Perl::GSSAPI — GSSAPI (Kerberos v5) SASL authentication class

## Synopsis

perl
use Authen::SASL qw(Perl);

$sasl = Authen::SASL->new(mechanism => 'GSSAPI');
$sasl = Authen::SASL->new(mechanism => 'GSSAPI',
                          callback => { pass => $mycred });

$sasl->client_start($service, $host);
## Options

### Callbacks

- `authname` — The authorization identity to be used in SASL exchange
- `gssmech` — The GSS mechanism to be used in the connection
- `pass` — (optional) A `GSSAPI::Cred` object to use as credentials

### Properties

- `maxbuf` — Maximum buffer size for receiving cipher text
- `minssf` — Minimum SSF value required from the security layer (default 0)
- `maxssf` — Maximum SSF value allowed (default 2^31)
- `externalssf` — SSF value from an external security layer (default 0)
- `ssf` — (read-only) Actual SSF value after authentication completes
- `maxout` — Maximum plaintext buffer size for sending data (set after security layer is active)

## Examples

**LDAP bind using GSSAPI (Kerberos) authentication:**

perl
use strict;
use Net::LDAP 0.33;
use Authen::SASL 2.10;

my $adhost      = 'theserver.bla.net';
my $ldap_base   = 'dc=bla,dc=net';
my $ldap_filter = '(&(sAMAccountName=BLAAGROL))';

my $sasl = Authen::SASL->new(mechanism => 'GSSAPI');
my $ldap;

eval {
    $ldap = Net::LDAP->new($adhost, onerror => 'die')
        or die "Cannot connect to LDAP host '$adhost': '$@'";
    $ldap->bind(sasl => $sasl);
};

if ($@) {
    chomp $@;
    die   "\nBind error         : $@",
          "\nDetailed SASL error: ", $sasl->error,
          "\nTerminated";
}

print "\nLDAP bind() succeeded, working in authenticated state";

my $mesg = $ldap->search(base   => $ldap_base,
                         filter => $ldap_filter);
## See Also

- [Authen::SASL](http://localhost/phpMan.php/perldoc/Authen%3A%3ASASL/markdown)
- [Authen::SASL::Perl](http://localhost/phpMan.php/perldoc/Authen%3A%3ASASL%3A%3APerl/markdown)