autofs-5.1.8 - ldap_sasl_interactive_bind() needs credentials for auto-detection From: Thomas Reim SASL mechanism auto-selection using ldap_sasl_interactive_bind() is tricky. The behaviour and the required information depend not only on the capabilities of Cyrus SASL on the client machine but also on supportedSASLmechanisms on the LDAP server. The latter information will be requested by libldap during SASL mechanism negotiation. Current OpenLDAP libldap implementation is to prefer user credential based SCRAM-* mechanisms on token based GSSAPI. Only exception are SASL bind requests to servers, e. g. Active Directory domain controllers, that have disabled all SASL mechanisms, which rely on user credential transfer between client and directory server. Current autofs implementation fetches user credential information from LDAP authentication configuration file for LDAP simple binds or if users explicitly specify a user credential based authentication mechanism (authtype). This patch makes specification of user credentials mandatory for SASL mechanism auto-detection using ldap_sasl_interactive_bind(). Users can then omit SASL authtype specification and automount will auto-select the best suited user credential based SASL mechanism supported by client and LDAP server. If authtype="GSSAPI" is specified together with authrequired="autodetect" automount will obtain a Kerberos ticket-granting ticket and bind to all Active Directory servers or use the specified user credentials to bind to all other LDAP servers that also support user credential based SASL mechanisms. The patch is backward compatible to implementations that use autofs function sasl_choose_mech(). The strategy of this function is to force users to specify the SASL mechanism (authtype) if user credentials shall be used for SASL binding and only perform auto-selection for server supported mechanisms, which are not based on user credentials. Signed-off-by: Thomas Reim --- CHANGELOG | 1 + modules/lookup_ldap.c | 45 ++++++++++++++++++++++++++++++++++++--------- 2 files changed, 37 insertions(+), 9 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 41e299fe..614f11fa 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -39,6 +39,7 @@ - more comprehensive verbose logging for LDAP maps. - fix invalid tsv access. - support SCRAM for SASL binding. +- ldap_sasl_interactive_bind() needs credentials for auto-detection. 19/10/2021 autofs-5.1.8 - add xdr_exports(). diff --git a/modules/lookup_ldap.c b/modules/lookup_ldap.c index 0803e09b..6b93a389 100644 --- a/modules/lookup_ldap.c +++ b/modules/lookup_ldap.c @@ -644,14 +644,14 @@ static int do_bind(unsigned logopt, struct ldap_conn *conn, sasl_flags = LDAP_SASL_QUIET; } - debug(logopt, "Attempting sasl bind with mechanism %s", ctxt->sasl_mech); - if (ctxt->auth_required & LDAP_AUTH_AUTODETECT) { if (ctxt->sasl_mech) { free(ctxt->sasl_mech); ctxt->sasl_mech = NULL; } - } + debug(logopt, "Attempting sasl bind with mechanism auto-select"); + } else + debug(logopt, "Attempting sasl bind with mechanism %s", ctxt->sasl_mech); /* * If LDAP_AUTH_AUTODETECT is set, it means that there was no @@ -1445,20 +1445,47 @@ int parse_ldap_config(unsigned logopt, struct lookup_context *ctxt) goto out; } +#ifndef WITH_LDAP_CYRUS_SASL if (auth_required == LDAP_AUTH_USESIMPLE || (authtype && authtype_requires_creds(authtype))) { +#else + /* + * OpenLDAP with Cyrus SASL needs user credentials for + * SASL mechanism auto-selection in following cases: + * (a) LDAP_AUTH_AUTODETECT + * (b) LDAP_AUTH_REQUIRED but no SASL mechanism specified + */ + if (auth_required == LDAP_AUTH_USESIMPLE || + (authtype && authtype_requires_creds(authtype)) || + (!authtype && (auth_required & LDAP_AUTH_REQUIRED)) || + (auth_required & LDAP_AUTH_AUTODETECT)) { +#endif char *s1 = NULL, *s2 = NULL; ret = get_property(logopt, root, "user", &user); ret |= get_property(logopt, root, "secret", &s1); ret |= get_property(logopt, root, "encoded_secret", &s2); if (ret != 0 || (!user || (!s1 && !s2))) { auth_fail: - error(logopt, - MODPREFIX - "%s authentication type requires a username " - "and a secret. Please fix your configuration " - "in %s.", authtype, auth_conf); - free(authtype); + if (auth_required == LDAP_AUTH_USESIMPLE) + error(logopt, + MODPREFIX + "Simple authentication requires a username " + "and a secret. Please fix your configuration " + "in %s.", auth_conf); + else if (authtype && authtype_requires_creds(authtype)) + error(logopt, + MODPREFIX + "%s authentication requires a username and " + "a secret. Please fix your configuration " + "in %s.", authtype, auth_conf); + else + error(logopt, + MODPREFIX + "SASL authentication auto-selection requires " + "a username and a secret. Please fix your " + "configuration in %s.", auth_conf); + if (authtype) + free(authtype); if (user) free(user); if (s1)