Bug 1154566

The reverted commit was doing changes according to RFC. But this change is probably not backward compatible with older versions.

Can you please post cyrus-sasl versions on server and client? Does it work for connections on between the same versions of cyrus-sasl, preferably rhel7 to rhel7?

Just tested your use case from rhel7 (without reverted commit) to fedora 21 machine (with reverted commit) configured by IPA and it still works for me with these versions:
cyrus-sasl-gssapi-2.1.26-17.el7.x86_64
openldap-clients-2.4.39-6.el7.x86_64

We can guess it is caused by this commit [1] that was reverted but before posting this into the world, I would like to have some reproducible justification, that it _is_ really broken. Also the other reports are using different use cases so we can only guess the similarity.

It looks like issue with AD server. Unfortunately I don't have such machine around here to test.

Can you test the package with reverted patch if it will solve your problem?

[1] https://cgit.cyrus.foundation/cyrus-sasl/commit/?id=080e51c7fa0421eb2f0210d34cf0ac48a228b1e9

with these libraries on the client

cyrus-sasl-lib-2.1.26-17.el7.x86_64
openldap-clients-2.4.39-6.el7.x86_64
cyrus-sasl-gssapi-2.1.26-17.el7.x86_64

and an active directory as the server (sorry not kerberized linux ldap server available)


without kerberos it works

ldapsearch \
   -x \
   -D CN=foobar,OU=... \
   -w secret \
   -H ldaps://ldap.example.com \
   -b dc=example,dc=com \
   CN=foobar

with kerberos

kinit, and then

ldapsearch \
   -Y GSSAPI \
   -Omaxssf=0 \
   -H ldaps://ldap.example.com \
   -b dc=example,dc=com \
   CN=foobar

doesn't work. error:

SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
	additional info: SASL(-1): generic failure: GSSAPI Error: A required input parameter could not be read (Unknown error)

i build a custom rpm using

https://git.centos.org/summary/rpms!cyrus-sasl

branch c7, a9a688bd21a6e3d6dce7ed2c9306548f46165adc

the source package from http://cyrusimap.org/releases/cyrus-sasl-2.1.26.tar.gz

and a slightly reduced reverse patch (https://cgit.cyrus.foundation/cyrus-sasl/commit/?id=080e51c7fa0421eb2f0210d34cf0ac48a228b1e9)

From 080e51c7fa0421eb2f0210d34cf0ac48a228b1e9 Mon Sep 17 00:00:00 2001
From: Alexey Melnikov <alexey.melnikov>
Date: Mon, 15 Feb 2010 12:23:45 +0000
Subject: Updated the list of GSS-API flags passed to gss_init_sec_context() as
 per RFC 4752.


diff --git a/plugins/gssapi.c b/plugins/gssapi.c
index 712b096..1da8cfc 100644
--- a/plugins/gssapi.c
+++ b/plugins/gssapi.c
@@ -1423,23 +1423,24 @@ static int gssapi_client_mech_step(void *conn_context,
            GSS_UNLOCK_MUTEX(params->utils);
            text->gss_ctx = GSS_C_NO_CONTEXT;
        }
-           
+
        /* Setup req_flags properly */
-       req_flags = GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG;
-       if(params->props.max_ssf > params->external_ssf) {
+       req_flags = GSS_C_INTEG_FLAG;
+       if (params->props.max_ssf > params->external_ssf) {
            /* We are requesting a security layer */
-           req_flags |= GSS_C_INTEG_FLAG;
+           req_flags |= GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG;
            /* Any SSF bigger than 1 is confidentiality. */
            /* Let's check if the client of the API requires confidentiality,
               and it wasn't already provided by an external layer */
-           if(params->props.max_ssf - params->external_ssf > 1) {
+           if (params->props.max_ssf - params->external_ssf > 1) {
                /* We want to try for privacy */
                req_flags |= GSS_C_CONF_FLAG;
            }
        }
-       
-       if (params->props.security_flags & SASL_SEC_PASS_CREDENTIALS)
+
+       if (params->props.security_flags & SASL_SEC_PASS_CREDENTIALS) {
            req_flags = req_flags |  GSS_C_DELEG_FLAG;
+       }
 
        GSS_LOCK_MUTEX(params->utils);
        maj_stat = gss_init_sec_context(&min_stat,
-- 
cgit v0.10.2




This setup works with kerberos and active directory

I can confirm the same problem and same steps to reproduce.

Environment:

Clients:
    Fedora21:
        cyrus-sasl-gssapi-2.1.26-19.fc21.x86_64
        openldap-clients-2.4.40-3.fc21.x86_64

    RHEL 7.1
        cyrus-sasl-gssapi-2.1.26-17.el7.x86_64
        openldap-clients-2.4.39-6.el7.x86_64

LDAP Server:
Microsoft Active Directory domain controller running on Windows Server 2008 R2 SP1. Domain and Forest fucntional levels: 2008 R2

My fedora client works fine using either a SASL bind to AD or a simple bind

My RHEL 7.1 client works with a simple bind but fails with the same error when using a SASL bind.

I was having problems compiling as described above so I just extracted the files from the fedora 'cyrus-sasl-gssapi' RPM and manually replaced the files on my RHEL 7.1 client which resolved the problem.

/usr/lib64/sasl2/libgssapiv2.so -> libgssapiv2.so.3.0.0
/usr/lib64/sasl2/libgssapiv2.so.3 -> libgssapiv2.so.3.0.0
/usr/lib64/sasl2/libgssapiv2.so.3.0.0

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2127.html