Authen::SASL::Perl::GSSAPI (3)

Leading comments

Automatically generated by Pod::Man 2.27 (Pod::Simple 3.28)

Standard preamble:
========================================================================

(The comments found at the beginning of the groff file "man3/Authen::SASL::Perl::GSSAPI.3pm".)

NAME

Authen::SASL::Perl::GSSAPI - GSSAPI (Kerberosv5) Authentication class

SYNOPSIS

  use Authen::SASL qw(Perl);

  $sasl = Authen::SASL->new( mechanism => 'GSSAPI' );

  $sasl = Authen::SASL->new( mechanism => 'GSSAPI',
                             callback => { pass => $mycred });

  $sasl->client_start( $service, $host );

DESCRIPTION

This method implements the client part of the algorithm, as described in section 7.2.1 resp. draft-ietf-sasl-gssapi-XX.txt.

With a valid Kerberos 5 credentials cache (aka

) it allows to connect to service@host given as the first two parameters to Authen::SASL's client_start() method. Alternatively, a GSSAPI::Cred object can be passed in via the Authen::SASL callback hash using the `pass' key.

Please note that this module does not currently implement a

security layer following authentication. Unless the connection is protected by other means, such as it will be vulnerable to man-in-the-middle attacks. If security layers are required, then the Authen::SASL::XS module should be used instead.

CALLBACK

The callbacks used are:

authname

The authorization identity to be used in

SASL

exchange

gssmech

The

GSS

mechanism to be used in the connection

pass

The

GSS

credentials to be used in the connection (optional)

EXAMPLE

 #! /usr/bin/perl -w

 use strict;

 use Net::LDAP 0.33;
 use Authen::SASL 2.10;

 # -------- Adjust to your environment --------
 my $adhost      = 'theserver.bla.net';
 my $ldap_base   = 'dc=bla,dc=net';
 my $ldap_filter = '(&(sAMAccountName=BLAAGROL))';

 my $sasl = Authen::SASL->new(mechanism => 'GSSAPI');
 my $ldap;

 eval {
     $ldap = Net::LDAP->new($adhost,
                            onerror => 'die')
       or  die "Cannot connect to LDAP host '$adhost': '$@'";
     $ldap->bind(sasl => $sasl);
 };

 if ($@) {
     chomp $@;
     die   "\nBind error         : $@",
           "\nDetailed SASL error: ", $sasl->error,
           "\nTerminated";
 }

 print "\nLDAP bind() succeeded, working in authenticated state";

 my $mesg = $ldap->search(base   => $ldap_base,
                          filter => $ldap_filter);

 # -------- evaluate $mesg

PROPERTIES

The properties used are:

maxbuf

The maximum buffer size for receiving cipher text

minssf

The minimum

SSF

value that should be provided by the

SASL

security layer. The default is 0

maxssf

The maximum

SSF

value that should be provided by the

SASL

security layer. The default is 2**31

externalssf

The

SSF

value provided by an underlying external security layer. The default is 0

ssf

The actual

SSF

value provided by the

SASL

security layer after the

SASL

authentication phase has been completed. This value is read-only and set by the implementation after the

SASL

authentication phase has been completed.

maxout

The maximum plaintext buffer size for sending data to the peer. This value is set by the implementation after the

SASL

authentication phase has been completed and a

SASL

security layer is in effect.

SEE ALSO

Authen::SASL, Authen::SASL::Perl

AUTHORS

Written by Simon Wilkinson, with patches and extensions by Achim Grolms and Peter Marschall.

Please report any bugs, or post any suggestions, to the perl-ldap mailing list <perl-ldap@perl.org>

COPYRIGHT

Copyright (c) 2006 Simon Wilkinson, Achim Grolms and Peter Marschall. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.