FreeBSD 8.2: state of Kerberos, GSS-API and (Cyrus) SASL?

[Vallo Kallaste]

On Mon, Jan 31, 2011 at 05:43:20PM +0100, Jan Henrik Sylvester
<me at janh.de> wrote:

> I am struggling with exactly the same problem. Unfortunately, I got
> no reply on this list about it:
> 
> http://lists.freebsd.org/pipermail/freebsd-questions/2011-January/226495.html
> 
> If you get any further, please, tell me. I am thinking about
> reposting my question to a different list: stable as that is where
> the earlier discussions happened or ports as that seems more
> appropriate.
> 
Installed net/openldap24-server port defining WITH_SASL=YES and it
seems that SASL/GSSAPI authentication works:

[vallo at kdc2 ~]$ klist
Credentials cache: FILE:/tmp/krb5cc_NoXXXX
        Principal: vallo at EXAMPLE.COM

  Issued           Expires          Principal
Feb  3 21:20:48  Feb  4 21:02:45  krbtgt/EXAMPLE.COM at EXAMPLE.COM
Feb  3 21:25:44  Feb  4 21:02:45  ldap/kdc2.internal at EXAMPLE.COM
[vallo at kdc2 ~]$ ldapsearch -Y GSSAPI -b '' -s base '(objectclass=*)' namingContexts
SASL/GSSAPI authentication started
SASL username: vallo at EXAMPLE.COM
SASL SSF: 56
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: namingContexts
#

#
dn:
namingContexts: dc=example,dc=com

# search result
search: 4
result: 0 Success

# numResponses: 2
# numEntries: 1

Slapd needs read access to /etc/krb5.keytab or separate keytab.
Keytab must contain ldap service account of course. This example was
done on the system the slapd runs on. Please let me know if you get
it working (or not).
-- 
Vallo