1Authen::SASL::Perl::GSSUAsPeIr(3C)ontributed Perl DocumeAnuttahteino:n:SASL::Perl::GSSAPI(3)
2
3
4

NAME

6       Authen::SASL::Perl::GSSAPI - GSSAPI (Kerberosv5) Authentication class
7

SYNOPSIS

9         use Authen::SASL qw(Perl);
10
11         $sasl = Authen::SASL->new( mechanism => 'GSSAPI' );
12
13         $sasl = Authen::SASL->new( mechanism => 'GSSAPI',
14                                    callback => { pass => $mycred });
15
16         $sasl->client_start( $service, $host );
17

DESCRIPTION

19       This method implements the client part of the GSSAPI SASL algorithm, as
20       described in RFC 2222 section 7.2.1 resp.
21       draft-ietf-sasl-gssapi-XX.txt.
22
23       With a valid Kerberos 5 credentials cache (aka TGT) it allows to
24       connect to service@host given as the first two parameters to
25       Authen::SASL's client_start() method.  Alternatively, a GSSAPI::Cred
26       object can be passed in via the Authen::SASL callback hash using the
27       `pass' key.
28
29       Please note that this module does not currently implement a SASL
30       security layer following authentication. Unless the connection is
31       protected by other means, such as TLS, it will be vulnerable to man-in-
32       the-middle attacks. If security layers are required, then the
33       Authen::SASL::XS GSSAPI module should be used instead.
34
35   CALLBACK
36       The callbacks used are:
37
38       authname
39           The authorization identity to be used in SASL exchange
40
41       gssmech
42           The GSS mechanism to be used in the connection
43
44       pass
45           The GSS credentials to be used in the connection (optional)
46

EXAMPLE

48        #! /usr/bin/perl -w
49
50        use strict;
51
52        use Net::LDAP 0.33;
53        use Authen::SASL 2.10;
54
55        # -------- Adjust to your environment --------
56        my $adhost      = 'theserver.bla.net';
57        my $ldap_base   = 'dc=bla,dc=net';
58        my $ldap_filter = '(&(sAMAccountName=BLAAGROL))';
59
60        my $sasl = Authen::SASL->new(mechanism => 'GSSAPI');
61        my $ldap;
62
63        eval {
64            $ldap = Net::LDAP->new($adhost,
65                                   onerror => 'die')
66              or  die "Cannot connect to LDAP host '$adhost': '$@'";
67            $ldap->bind(sasl => $sasl);
68        };
69
70        if ($@) {
71            chomp $@;
72            die   "\nBind error         : $@",
73                  "\nDetailed SASL error: ", $sasl->error,
74                  "\nTerminated";
75        }
76
77        print "\nLDAP bind() succeeded, working in authenticated state";
78
79        my $mesg = $ldap->search(base   => $ldap_base,
80                                 filter => $ldap_filter);
81
82        # -------- evaluate $mesg
83
84   PROPERTIES
85       The properties used are:
86
87       maxbuf
88           The maximum buffer size for receiving cipher text
89
90       minssf
91           The minimum SSF value that should be provided by the SASL security
92           layer.  The default is 0
93
94       maxssf
95           The maximum SSF value that should be provided by the SASL security
96           layer.  The default is 2**31
97
98       externalssf
99           The SSF value provided by an underlying external security layer.
100           The default is 0
101
102       ssf The actual SSF value provided by the SASL security layer after the
103           SASL authentication phase has been completed. This value is read-
104           only and set by the implementation after the SASL authentication
105           phase has been completed.
106
107       maxout
108           The maximum plaintext buffer size for sending data to the peer.
109           This value is set by the implementation after the SASL
110           authentication phase has been completed and a SASL security layer
111           is in effect.
112

SEE ALSO

114       Authen::SASL, Authen::SASL::Perl
115

AUTHORS

117       Written by Simon Wilkinson, with patches and extensions by Achim Grolms
118       and Peter Marschall.
119
120       Please report any bugs, or post any suggestions, to the perl-ldap
121       mailing list <perl-ldap@perl.org>
122

124       Copyright (c) 2006 Simon Wilkinson, Achim Grolms and Peter Marschall.
125       All rights reserved. This program is free software; you can
126       redistribute it and/or modify it under the same terms as Perl itself.
127
128
129
130perl v5.36.0                      2023-01-20     Authen::SASL::Perl::GSSAPI(3)
Impressum