Bug 2011295

Description of problem:
1. Unnecessary check for ldap-gssapi-keytab parameter
ldap_krb_helper.c defines a default value for this parameter, so there is no need to check in ldap.c

ldap_krb_helper.c:
50: #define KRB_DEFAULT_KEYTAB "FILE:/etc/dhcp/dhcp.keytab"

142:    if (keyfile == NULL || keyfile[0] == '\0') {
143:        keyfile = KRB_DEFAULT_KEYTAB;
144:        log_info("Using default keytab %s\n", keyfile);

and return an error if it is missing:
systemd[1]: Starting DHCPv4 Server Daemon...
dhcpd[162338]: Internet Systems Consortium DHCP Server 4.4.2b1
dhcpd[162338]: Copyright 2004-2019 Internet Systems Consortium.
dhcpd[162338]: All rights reserved.
dhcpd[162338]: For info, please visit https://www.isc.org/software/dhcp/
dhcpd[162338]: ldap_gssapi_keytab must be specified

2. dhcpd does not start with openldap GSSAPI: 
dhcpd[78973]: Copyright 2004-2019 Internet Systems Consortium.
dhcpd[78973]: All rights reserved.
dhcpd[78973]: For info, please visit https://www.isc.org/software/dhcp/
dhcpd[78973]: TLS session successfully started to ldap.example.com:389
dhcpd[78973]: Using ccache MEMORY:dhcp_ld_krb5_cc
dhcpd[78973]: Credentials are not present in cache (Matching credential not found)
dhcpd[78973]: No valid krb5 credentials
dhcpd[78973]: Successfully init krb tgt dhcp/ldap.example.com
dhcpd[78973]: GSSAPI client step 1
dhcpd[78973]: doing interactive bind
dhcpd[78973]: got request for SASL_CB_USER dhcp/ldap.example.com
dhcpd[78973]: GSSAPI client step 1
dhcpd[78973]: GSSAPI client step 1
dhcpd[78973]: GSSAPI client step 2
dhcpd[78973]: Error: Cannot SASL bind to ldap server ldap.example.com:389: Insufficient access
dhcpd[78973]:         Additional info: SASL(-14): authorization failure: Inappropriate authentication
dhcpd[78973]: Configuration file errors encountered -- exiting

If the empty string "" is used for the SASL_CB_USER value, then the authorization is successful:
--- ldap.c.orig	2021-10-06 12:13:42.232247727 +0300
+++ ldap.c	2021-10-06 12:15:28.852500978 +0300
@@ -3113,6 +3113,7 @@
     switch (in->id) {
       case SASL_CB_USER:
         log_info("got request for SASL_CB_USER %s", ldap_inst->sasl_authz_id);
+        ldap_inst->sasl_authz_id = ""
         size = strlen(ldap_inst->sasl_authz_id);
         in->result = ldap_inst->sasl_authz_id;
         in->len = size;

systemd[1]: Starting DHCPv4 Server Daemon...
dhcpd[162348]: Internet Systems Consortium DHCP Server 4.4.2b1
dhcpd[162348]: Copyright 2004-2019 Internet Systems Consortium.
dhcpd[162348]: All rights reserved.
dhcpd[162348]: For info, please visit https://www.isc.org/software/dhcp/
dhcpd[162348]: TLS session successfully started to ldap.example.com:389
dhcpd[162348]: Using ccache MEMORY:dhcp_ld_krb5_cc
dhcpd[162348]: Credentials are not present in cache (Matching credential not found)
dhcpd[162348]: No valid krb5 credentials
dhcpd[162348]: Successfully init krb tgt dhcp/ldap.example.com
dhcpd[162348]: GSSAPI client step 1
dhcpd[162348]: doing interactive bind
dhcpd[162348]: got request for SASL_CB_USER dhcp/ldap.example.com
dhcpd[162348]: GSSAPI client step 1
dhcpd[162348]: GSSAPI client step 1
dhcpd[162348]: GSSAPI client step 2
dhcpd[162348]: Config file: /etc/dhcp/dhcpd.conf
dhcpd[162348]: Database file: /var/lib/dhcpd/dhcpd.leases
dhcpd[162348]: PID file: /var/run/dhcpd.pid
dhcpd[162348]: Source compiled to use binary-leases
dhcpd[162348]: Wrote 0 deleted host decls to leases file.
dhcpd[162348]: Wrote 0 new dynamic host decls to leases file.
dhcpd[162348]: Wrote 0 leases to leases file.

A similar code for authorization via GSSAPI is used in bind-dyndb-ldap, but there the value of the sasl_user parameter (default "") is used to set the SASL_CB_USER, and if this parameter is absent or it is explicitly set to "", the problem with openldap does not arise.

In the case of dhcpd, this value is hardcoded to the ldap-gssapi-principal.
ldap.c:
1387:        running = strdup(ldap_gssapi_principal);
1388:        if (running == NULL)
1389:          log_fatal("Could not allocate memory  to duplicate gssapi principal");
1390:
1391:        gssapi_user = strtok(running, gssapi_delim);
1392:        if (!gssapi_user || strlen(gssapi_user) == 0) {
1393:          log_fatal ("GSSAPI principal must specify user: user@realm");
1394:        }

Version-Release number of selected component (if applicable):
dhcp-server-4.4.2-16.b1.fc34.x86_64
openldap-servers-2.4.57-5.fc34.x86_64
krb5-server-1.19.2-2.fc34.x86_64

How reproducible:
always reproducible.

Steps to Reproduce:
1. Install openldap, krb5, dhcp
2. Configure the dhcp-server, krb5 and openldap
3. dhcpd.conf:
ldap-gssapi-principal "dhcp/ldap.example.com";
ldap-gssapi-keytab "FILE:/etc/dhcp/dhcp.keytab";
ldap-server "ldap.example.com";
ldap-port 389;
ldap-base-dn "ou=DHCP,dc=example,dc=com";
ldap-method static;
ldap-ssl start_tls;
ldap-tls-ca-file "/etc/pki/tls/certs/ca.crt";
ldap-tls-cert "/etc/pki/tls/certs/ldap.crt";
ldap-tls-key "/etc/pki/tls/private/ldap.key";

Actual results:
1. If you comment out ldap-gssapi-keytab:
dhcpd[162338]: ldap_gssapi_keytab must be specified

2.
dhcpd[78973]: Error: Cannot SASL bind to ldap server ldap.example.com:389: Insufficient access
dhcpd[78973]:         Additional info: SASL(-14): authorization failure: Inappropriate authentication

Expected results:
1. The default for ldap_gssapi_keytab would be used.

2. It would be possible to set sasl_xxx options in a similar way to bind-dyndb-ldap.

Additional info: