Trouble with ldap + sasl + gssapi + kerberos against Active Directory Server

[Hadmut Danisch]

Hi,

I am just trying to use ldap with kerberos to connect to a Microsoft Active
Directory Server. Works pretty well with command line tools (ldapsearch),
but with ruby I always run into the error message

Error gss_init_sec_context did not return GSS_S_COMPLETE


Unfortunately, I could not find a precise documentation of what exact
behaviour NET::LDAP.new expects from the challenge_response function. By
the way, there are two gems available, net-ldap-0.6.1 and net-ldap2-0.5.0,
but they differ only in some specs and docs. Why is there two versions, and
which one should I use?


What I am trying to do is

cli = GSSAPI::Simple.new(adserver,'ldap')

token = cli.init_context.force_encoding('binary')

puts "OUT #{token.size}"

ldap = Net::LDAP.new :host => adserver,
:auth => {
:method => :sasl,
:mechanism => 'GSSAPI',
:initial_credential => token,
:challenge_response => lambda do |inp|
puts "INP #{inp.size}"
case out = cli.init_context(inp)
when true ; puts "OUT #{out}" ; out
when String ; puts "OUT #{out.size}" ;
out.force_encoding('binary')
else warn "init context class #{out.class}"
end
end
}


puts "Starting Query"

ldap.search(:base => "") do |entry|
puts entry
end



(where adserver is the name of the Active Directory Server), which almost
seems to work, at least it goes through some steps of the kerberos protocol
and prints

OUT 1426
Starting Query
INP 156
OUT true
INP 32
Error gss_init_sec_context did not return GSS_S_COMPLETE
GSSAPI::GssApiError



So the local gssapi object seems to find a success (since it replies with
true instead of a string), but NET::LDAP tries to proceed with sasl. I am
not sure why the gssapi part returns true, but lateron complains about not
getting GSS_S_COMPLETE.





I tried to compare this with a successfull ldapsearch and found that
ldapsearch does a

-> bindRequest(1) sasl
<- saslBindInProgress
-> bindRequest(2) sasl
<- sasBindInProgress
-> bindRequest(3) sasl
<- bindResponse(3) success
-> SASL GSS-API Privacy; payload


while the ruby version aborts after the fourth step. I also found that both
tell the Server that they wish to use GSSAPI Mechanisms in the third step,
but the ruby version has three 01 bytes after GSSAPI, while the ldapsearch
chat doesn't. Wireshark complains that these three 01 bytes make the paket
invalid. Maybe that's an encoding problem of net-ldap.


Unfortunately, both debugging and documentation for both gssapi and ruby
net-ldap are poor for this kind of use. I am not yet sure whether I have a
problem with the gssapi or the net-ldap part.


Has anyone working code to authenticate with kerberos against an AD server?

regards
Hadmut