Problems with GSSAPI and LDAP

Juha Koho juha.koho at trineco.fi
Wed Oct 12 07:27:47 UTC 2016


On 2016-10-11 12:10, Juha Koho wrote:
> On 2016-10-11 11:03, Aki Tuomi wrote:
>> On 11.10.2016 11:56, Juha Koho wrote:
>>> 
>>> On 2016-10-11 10:00, Aki Tuomi wrote:
>>>> On 11.10.2016 10:43, Juha Koho wrote:
>>>>> 
>>>>> On 2016-10-11 09:18, Aki Tuomi wrote:
>>>>>> On 11.10.2016 10:13, Juha Koho wrote:
>>>>>>> Hello,
>>>>>>> 
>>>>>>> I have a Dovecot 2.2.25 set up with OpenLDAP back end. I was
>>>>>>> trying to
>>>>>>> set up a GSSAPI Kerberos authentication with the LDAP server but 
>>>>>>> with
>>>>>>> little success. Seems no matter what I try I end up with the
>>>>>>> following
>>>>>>> error message:
>>>>>>> 
>>>>>>> dovecot: auth: Error: LDAP: binding failed (dn
>>>>>>> (imap/host.example.com at EXAMPLE.COM)): Local error, SASL(-1): 
>>>>>>> generic
>>>>>>> failure: GSSAPI Error: Unspecified GSS failure.  Minor code may
>>>>>>> provide more information (No Kerberos credentials available 
>>>>>>> (default
>>>>>>> cache: FILE:/tmp/dovecot.krb5.ccache))
>>>>>>> 
>>>>>>> I have set the import_environment in dovecot.conf:
>>>>>>> 
>>>>>>> import_environment = TZ CORE_OUTOFMEM CORE_ERROR LISTEN_PID
>>>>>>> LISTEN_FDS
>>>>>>> KRB5CCNAME=FILE:/tmp/dovecot.krb5.ccache
>>>>>>> 
>>>>>>> And these in LDAP configuration:
>>>>>>> 
>>>>>>> dn = imap/host.example.com at EXAMPLE.COM
>>>>>>> sasl_bind = yes
>>>>>>> sasl_mech = gssapi
>>>>>>> sasl_realm = EXAMPLE.COM
>>>>>>> sasl_authz_id = imap/host.example.com at EXAMPLE.COM
>>>>>>> 
>>>>>>> I have tried with different values in dn and sasl_authz_id and 
>>>>>>> also
>>>>>>> leaving them out completely but I always end up with the error
>>>>>>> message
>>>>>>> above. Using simple bind without GSSAPI works just fine.
>>>>>>> 
>>>>>>> The credentials cache file exists and is valid for the principal
>>>>>>> imap/host.example.com at EXAMPLE.COM. The file is owned by dovecot 
>>>>>>> user
>>>>>>> so it shouldn't be a permission problem either.
>>>>>>> 
>>>>>>> GSSAPI in OpenLDAP works but I suppose it is irrelevant here 
>>>>>>> since
>>>>>>> the
>>>>>>> connection attempt never reaches the LDAP server due to the 
>>>>>>> error. I
>>>>>>> also have similar setup for Postfix and it works fine.
>>>>>>> 
>>>>>>> Any ideas what to try next?
>>>>>>> 
>>>>>>> Best regards,
>>>>>>> Juha
>>>>>> 
>>>>>> Can you provide klist output for the cache file? Also, it should 
>>>>>> be
>>>>>> readable by dovenull user, or whatever is configured as
>>>>>> default_login_user.
>>>>> 
>>>>> 
>>>>> Here's the klist output of the cache file:
>>>>> --
>>>>> Ticket cache: FILE:/tmp/dovecot.krb5.ccache
>>>>> Default principal: imap/host.example.com at EXAMPLE.COM
>>>>> 
>>>>> Valid starting       Expires              Service principal
>>>>> 10/11/2016 09:26:25  10/11/2016 21:26:25
>>>>> krbtgt/EXAMPLE.COM at EXAMPLE.COM
>>>>>         renew until 10/12/2016 09:26:25
>>>>> ---
>>>>> 
>>>>> That I didn't know that also dovenull must have access to the cache
>>>>> but I tried also setting 0644 permissions to the cache file with no
>>>>> luck. So permissions shouldn't be the issue...
>>>>> 
>>>>> Juha
>>>> 
>>>> Your ccache has no ticket for imap/host.example.com at EXAMPLE.COM
>>>> 
>>>> please use kinit to acquire one.
>>> 
>>> 
>>> Now I'm confused. The cache file is created by kinit using the 
>>> command:
>>> 
>>> sudo -u dovenull kinit -c FILE:/tmp/dovecot.krb5.ccache -k -t
>>> /path/to/keytab imap/host.example.com
>>> 
>>> After that:
>>> 
>>> $ sudo -u dovenull klist /tmp/dovecot.krb5.ccache
>>> Ticket cache: FILE:/tmp/dovecot.krb5.ccache
>>> Default principal: imap/host.example.com at EXAMPLE.COM
>>> 
>>> Valid starting       Expires              Service principal
>>> 10/11/2016 10:47:47  10/11/2016 22:47:47  
>>> krbtgt/EXAMPLE.COM at EXAMPLE.COM
>>>         renew until 10/12/2016 10:47:47
>>> 
>>> Also, I can use the cache file with ldapsearch just fine by running
>>> the following:
>>> 
>>> sudo -u dovenull KRB5CCNAME=FILE:/tmp/dovecot.krb5.ccache ldapsearch
>>> -Y GSSAPI -ZZ -H ldap://ldap.example.com/ -b dc=example,dc=com
>>> 
>>> After the ldapsearch has succeeded the klist output is the following:
>>> 
>>> $ sudo -u dovenull klist /tmp/dovecot.krb5.ccache
>>> Ticket cache: FILE:/tmp/dovecot.krb5.ccache
>>> Default principal: imap/host.example.com at EXAMPLE.COM
>>> 
>>> Valid starting       Expires              Service principal
>>> 10/11/2016 10:47:47  10/11/2016 22:47:47  
>>> krbtgt/EXAMPLE.COM at EXAMPLE.COM
>>>         renew until 10/12/2016 10:47:47
>>> 10/11/2016 10:49:32  10/11/2016 22:47:47
>>> ldap/ldap.example.com at EXAMPLE.COM
>>>         renew until 10/12/2016 10:47:47
>>> 
>>> 
>>> Which is what I expected. Isn't this basically what dovecot does (or
>>> should do) or did I miss something?
>>> 
>>> Juha
>> 
>> Dovecot won't acquire service tickets for you. It requires that you 
>> have
>> ticket for imap/imap.example.com at EXAMPLE.COM in the cache or keytab.
>> 
>> The default principal is used when *CONNECTING* to a service, but you
>> are *ACCEPTING* a service, so you need a service principal.
>> 
>> Aki
> 
> Sorry, all this Kerberos stuff is quite new to me and I'm still a bit
> confused... :) What I still fail to understand is why would I need the
> service principal in the cache since I'm trying to set dovecot to use
> GSSAPI when connecting to the LDAP back end for passdb and userdb
> lookups.
> 
> My imap users can connect to Dovecot using GSSAPI without problems.
> This isn't the issue. Dovecot being the client to the LDAP service is
> the issue.
> 
> But anyway, after adding the ticket for
> imap/host.example.com at EXAMPLE.COM in the cache the error still
> remains:
> 
> dovecot: auth: Error: LDAP: binding failed (dn
> imap/host.example.com at EXAMPLE.COM): Local error, SASL(-1): generic
> failure: GSSAPI Error: Unspecified GSS failure.  Minor code may
> provide more information (No Kerberos credentials available (default
> cache: FILE:/tmp/dovecot.krb5.ccache))
> 
> $ sudo -u dovenull klist /tmp/dovecot.krb5.ccache
> Ticket cache: FILE:/tmp/dovecot.krb5.ccache
> Default principal: imap/host.example.com at EXAMPLE.COM
> 
> Valid starting       Expires              Service principal
> 10/11/2016 11:00:50  10/11/2016 23:00:50  
> krbtgt/EXAMPLE.COM at EXAMPLE.COM
>         renew until 10/12/2016 11:00:50
> 10/11/2016 11:19:09  10/11/2016 23:00:50  imap/host.example.com@
>         renew until 10/12/2016 11:00:50
> 10/11/2016 11:19:09  10/11/2016 23:00:50  
> imap/host.example.com at EXAMPLE.COM
>         renew until 10/12/2016 11:00:50
> 
> Juha

Just to let anyone interested know the configuration was correct but 
this turned out to be some sort of library incompatibility or whatever.

I cloned the configuration to a new virtual server and compiled a fresh 
copy of Dovecot from source (tried  git master and release-2.2.25) and 
it worked without problems.

I also noticed that with the freshly compiled version the error message 
changed to

dovecot: auth: Error: LDAP: binding failed (dn (none)): Local error, 
SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor 
code may provide more information (No Kerberos credentials available: 
Credentials cache permissions incorrect (filename: 
/tmp/dovecot.krb5.ccache))

if the permissions of the cache file were incorrect instead of this 
general error message above. So seems like the issue - whatever it was - 
caused that Dovecot (or the underlying libraries) were unable to locate 
or open the cache file in the first place.

Juha


More information about the dovecot mailing list