GSP
Quick Navigator

Search Site

Unix VPS
A - Starter
B - Basic
C - Preferred
D - Commercial
MPS - Dedicated
Previous VPSs
* Sign Up! *

Support
Contact Us
Online Help
Handbooks
Domain Status
Man Pages

FAQ
Virtual Servers
Pricing
Billing
Technical

Network
Facilities
Connectivity
Topology Map

Miscellaneous
Server Agreement
Year 2038
Credits
 

USA Flag

 

 

Man Pages


Manual Reference Pages  -  AUTHEN::SASL::PERL::GSSAPI (3)

.ds Aq ’

NAME

Authen::SASL::Perl::GSSAPI - GSSAPI (Kerberosv5) Authentication class

CONTENTS

SYNOPSIS



  use Authen::SASL qw(Perl);

  $sasl = Authen::SASL->new( mechanism => GSSAPI );

  $sasl = Authen::SASL->new( mechanism => GSSAPI,
                             callback => { pass => $mycred });

  $sasl->client_start( $service, $host );



DESCRIPTION

This method implements the client part of the GSSAPI SASL algorithm, as described in RFC 2222 section 7.2.1 resp. draft-ietf-sasl-gssapi-XX.txt.

With a valid Kerberos 5 credentials cache (aka TGT) it allows to connect to service@host given as the first two parameters to Authen::SASL’s client_start() method. Alternatively, a GSSAPI::Cred object can be passed in via the Authen::SASL callback hash using the ‘pass’ key.

Please note that this module does not currently implement a SASL security layer following authentication. Unless the connection is protected by other means, such as TLS, it will be vulnerable to man-in-the-middle attacks. If security layers are required, then the Authen::SASL::XS GSSAPI module should be used instead.

    CALLBACK

The callbacks used are:
authname The authorization identity to be used in SASL exchange
gssmech The GSS mechanism to be used in the connection
pass The GSS credentials to be used in the connection (optional)

EXAMPLE



 #! /usr/bin/perl -w

 use strict;

 use Net::LDAP 0.33;
 use Authen::SASL 2.10;

 # -------- Adjust to your environment --------
 my $adhost      = theserver.bla.net;
 my $ldap_base   = dc=bla,dc=net;
 my $ldap_filter = (&(sAMAccountName=BLAAGROL));

 my $sasl = Authen::SASL->new(mechanism => GSSAPI);
 my $ldap;

 eval {
     $ldap = Net::LDAP->new($adhost,
                            onerror => die)
       or  die "Cannot connect to LDAP host $adhost: $@";
     $ldap->bind(sasl => $sasl);
 };

 if ($@) {
     chomp $@;
     die   "\nBind error         : $@",
           "\nDetailed SASL error: ", $sasl->error,
           "\nTerminated";
 }

 print "\nLDAP bind() succeeded, working in authenticated state";

 my $mesg = $ldap->search(base   => $ldap_base,
                          filter => $ldap_filter);

 # -------- evaluate $mesg



    PROPERTIES

The properties used are:
maxbuf The maximum buffer size for receiving cipher text
minssf The minimum SSF value that should be provided by the SASL security layer. The default is 0
maxssf The maximum SSF value that should be provided by the SASL security layer. The default is 2**31
externalssf The SSF value provided by an underlying external security layer. The default is 0
ssf The actual SSF value provided by the SASL security layer after the SASL authentication phase has been completed. This value is read-only and set by the implementation after the SASL authentication phase has been completed.
maxout The maximum plaintext buffer size for sending data to the peer. This value is set by the implementation after the SASL authentication phase has been completed and a SASL security layer is in effect.

SEE ALSO

Authen::SASL, Authen::SASL::Perl

AUTHORS

Written by Simon Wilkinson, with patches and extensions by Achim Grolms and Peter Marschall.

Please report any bugs, or post any suggestions, to the perl-ldap mailing list <perl-ldap@perl.org>

COPYRIGHT

Copyright (c) 2006 Simon Wilkinson, Achim Grolms and Peter Marschall. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.
Search for    or go to Top of page |  Section 3 |  Main Index


perl v5.20.3 AUTHEN::SASL::PERL::GSSAPI (3) 2010-03-11

Powered by GSP Visit the GSP FreeBSD Man Page Interface.
Output converted with manServer 1.07.