How to test ldap that authenticates with kerberos

Question

I want to test an ldap directory with ldapsearch. No passwords are stored in the LDAP directory. Account passwords are stored in Kerberos and LDAP contains a pointer to the Kerberos principal. The ldap has an attribute userPassword

Attribute Name: 'userPassword'
OID:    2.5.4.35
URN:    urn:oid:2.5.4.35
Multiple Values:    Multi-valued (treated as Single-valued) 

I tried to search an user with the command

$ ldapsearch -vvv -x -D 'cn=xxxxxx,ou=xxx,dc=xxxx,dc=xxx' -h 'xxxxxxxx.xxxx.xxx' -W
ldap_initialize( ldap://xxxxxxxx.xxxx.xxx )
Enter LDAP Password:
ldap_bind: Invalid credentials (49)

Seems the ldap server cannot get the credential since itself doesn't store the passwords. Can the search be done under this circumstances? How to authenticate logins using ldap via kerberos?

Answer 1

There are two possible authentication methods here:

1. "Fake" Kerberos, where the LDAP server receives a plain password and checks it by attempting to obtain a TGT using that password. For this to work with OpenLDAP, you need:

   • The userPassword attribute must be set to the special value {SASL}user@REALM (with the actual Kerberos principal of course). The text after {SASL} is the username that OpenLDAP will give to libsasl, along with the received password.

   • libsasl must be configured to use saslauthd as the password check mechanism, by putting the following in /usr/lib/sasl2/slapd.conf:

     pwcheck_method: saslauthd
     

     And another line to make it offer the SASL PLAIN mechanism:

     mech_list: plain
     

   • On the same server, the saslauthd daemon must be running (it is part of libsasl; usually the "cyrus-sasl" or "sasl2-bin" package). This daemon performs the actual password verification on behalf of OpenLDAP or other servers.

   • The saslauthd daemon must also be configured to use Kerberos 5 using ‑a kerberos5 as a command-line option.

   With this, you should be able to use your Kerberos password with a simple bind (ldapsearch ‑x ‑D ... ‑W) or a SASL PLAIN bind (ldapsearch ‑Y PLAIN). It is however still "fake", as it doesn't take advantage of Kerberos features for protecting the password over the network.

2. "Real" Kerberos, where the LDAP server receives a Kerberos ticket and checks it against the local keytab, without having to ever reveal the password. For this to work with OpenLDAP, you need:

   • The system keytab must have keys for the ldap/fqdn@REALM principal, where fqdn must match the reverse-DNS of the server's IP address. You can use the ktadd command in kadmin to extract keys into a keytab.

   • The keytab must also be accessible by OpenLDAP (usually the ldap or slapd account). (If necessary, you can use a separate keytab file from the system one; in this case, OpenLDAP must have the $KRB5_KTNAME environment variable pointing to the dedicated keytab.)

   • libsasl on the server must be configured to offer the GSSAPI and/or GS2-KRB5 mechanisms. This is usually the default, but you might need to put the following in /usr/lib/sasl2/slapd.conf:

     mech_list: gs2-krb5 gssapi plain
     

     Since there is no password checking on the server, saslauthd is optional.

   With this, you should be able to kinit on a client, and use the obtained ticket with SASL GSSAPI bind (ldapsearch -Y GS2-KRB5 or ldapsearch -Y GSSAPI).