Support for GSSAPI/SASL

[chriskuehl]

First, thanks for a really well done library! It's already been extraordinarily helpful for us.

Our local setup uses the GSSAPI SASL mechanism to authenticate to LDAP via Kerberos. From reading the code, I don't think this is currently supported by ldap3, though it looks like some other SASL mechanisms are supported already.

I'm not sure how practical it is, but it'd be really cool if this was supported in some future release.

I notice there's a python-gssapi module, which looks like it might be helpful, but it's using a C extension to interface with GSSAPI, which I'm guessing might be an issue.

I'm going to try to get something working with python-gssapi as a starting point, but any insights you have would be greatly appreciated!

[cannatag]

Hi, I'd like to add the kerberos authentication feature with pure-python code (without any C extension). My problem is that I don't have any kerberos infrastructure to test the authentication. In the meanwhile II've found a gist on https://gist.github.com/sigmaris/f4bf307e97b449148d78 that integrates the python-gssapi module with ldap3. Can you give a look and tell me if this is working for you?

Thanks,
Giovanni

[chriskuehl]

Thanks for the speedy reply! I spent a couple hours trying to get the patch working, but haven't yet succeeded. The GSSAPI context is being established successfully, but then I receive a cryptic error message:

gssapi.error.MechDefectiveToken: (589824) Invalid token was supplied. Minor code: (100001) Success.

...which I haven't yet been able to track down.

Here's a gist with the changes (as I've integrated them into the current ldap3 dev branch) I'm using to test:
https://gist.github.com/chriskuehl/43dbc4281074a62a338d

The script I'm testing with is:
https://gist.github.com/chriskuehl/61bc3dadfb3780b99d5a

I've made a few changes (marked with "XXX:" and a comment) to the gist you found. I haven't yet found a way to get it working, but I'll keep poking at it and trying to make progress. Some of my changes might not be correct, as I've been trying a few different things without fully understanding them.

I'll report back if I find out anything else.

We'd also be more than happy to provide you access to our Kerberos/LDAP infrastructure to test on, if you'd like!

[cannatag]

Hi Chris,
Please have a look at issue #24. I've been working on native NTLM v2 authentication and have a working version in dev. In case you are using Kerberos on Windows maybe this feature could help you.

Anyway I will work on Kerberos authentication soon.

Bye,
Giovanni

----- Messaggio originale -----
Da: "Chris Kuehl" notifications@github.com
Inviato: ‎20/‎03/‎2015 22:55
A: "cannatag/ldap3" ldap3@noreply.github.com
Cc: "Giovanni Cannata" cannatag@gmail.com
Oggetto: Re: [ldap3] Support for GSSAPI/SASL (#33)

Thanks for the speedy reply! I spent a couple hours trying to get the patch working, but haven't yet succeeded. The GSSAPI context is being established successfully, but then I receive a cryptic error message:
gssapi.error.MechDefectiveToken: (589824) Invalid token was supplied. Minor code: (100001) Success.
...which I haven't yet been able to track down.
Here's a gist with the changes (as I've integrated them into the current ldap3 dev branch) I'm using to test:
https://gist.github.com/chriskuehl/43dbc4281074a62a338d
The script I'm testing with is:
https://gist.github.com/chriskuehl/61bc3dadfb3780b99d5a
I've made a few changes (marked with "XXX:" and a comment) to the gist you found. I haven't yet found a way to get it working, but I'll keep poking at it and trying to make progress. Some of my changes might not be correct, as I've been trying a few different things without fully understanding them.
I'll report back if I find out anything else.
We'd also be more than happy to provide you access to our Kerberos/LDAP infrastructure to test on, if you'd like!
—
Reply to this email directly or view it on GitHub.

[pefoley2]

I'm also interested in this, and managed to get a modified version of the above gist working.
My code is at https://gist.github.com/pefoley2/c6991488e303cc46f8fa

[cannatag]

thanks! I will check your code.

Bye,
Giovanni

[cannatag]

Hi Peter, I've adapted your code to be used in the ldap3 library, but cannot test it. Can you give a try with the version in dev?

Thanks,
Giovanni

[pefoley2]

It works correctly against my test system, thanks a lot!

[chriskuehl]

@pefoley2 would you be able to share the code you're using to test? I've been unsuccessfully trying to get the dev branch working with our LDAP/Kerberos installation. It's actually binding via GSSAPI properly, but queries aren't being received properly by ldap3 (although the server logs look like it was completed and returned successfully).

Additionally, are you using MIT or Heimdal? Do you require SSL/TLS for all LDAP connections?

Thanks so much both of you!

[pefoley2]

My script is here, https://gist.github.com/pefoley2/ea7aa9aa5964a998203d
I run kinit username@REALM and then the script and who_am_i returns the correct result.
The tls stuff is unused, because I haven't setup the correct certs yet on the server, so I can't test that.
I've also verified correct functionality with the webapp I need gssapi support for.
I built the gssapi module against MIT, as it didn't compile correctly against heimdal and I wasn't sure how to fix that.
Let me know if you need more info.

[pefoley2]

pythongssapi/python-gssapi#61 should fix heimdal support, I'll test that too at some point.

[chriskuehl]

Thanks for the additional info! Your code is working for me as well (who_am_i() returns the correct user), so it seems that the authentication is happening successfully.

Unfortunately, I'm not actually able to make LDAP queries; they all return an empty list. The code I'm using is here.

Are these kind of queries working for you?

[pefoley2]

Yep, I got a full set of attrs w/ mit. heimdal is currently crashing on me, but I think that's a separate issue.

[DirectXMan12]

Hi! I'm one of the devs from python-gssapi. I just wanted to let you know that if you need an easy way to set up a Kerberos environment for testing, the file gssapi/tests/k5test.py in python-gssapi may be of some use.

It sets up a self-contained MIT krb5 environment to test in (assuming you have the appropriate krb5 packages installed). You can either use it from a unit test (like we do in the python-gssapi unit tests), or through the gssapi-console.py (which is like an interactive Python console, but with a krb5 environment automatically set up and torn down).

[pefoley2]

I tested this with python2.7 and it appears to need from future import absolute_import because the name of the file is the same as the name of the module it imports.

[cannatag]

thanks. I've changed the module name from gssapi.py to kerberos.py.

[cannatag]

Thanks DirectXMan12, I will check your k5test.py. Can I set it up on a WIndows machine or I need to use it on Linux?

Bye,
Giovanni

[DirectXMan12]

@cannatag : currently, it requires Linux, or something similar

[cannatag]

Hi DirectXMan12, you mean that the Kerberos environment in k5test.py works on Linux only or that the whole python-gssapi itself is intended to be used only on LInux?

thanks,
Giovanni

[DirectXMan12]

@cannatag : the test environment currently only works on Linux. Hypothetically, python-gssapi itself should work on Windows when using a library for Windows that provides GSSAPI (e.g. MIT krb5 for Windows), but this has not yet been tested. If you find any issues on Windows, please let us know.

[cannatag]

released in 0.9.8.3