© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
513534c
demo site
(Get the code!)
> Are you uncertain if your issue is really a bug?
Effect is an authentication error. Root case is a "missing feature" (see below) and requires updating dependencies, downporting.
> If you are certain this is a bug please include the source package the bug is in.
It's in the interaction between three libraries: openldap, cyrus-sasl, krb5
> 1) The release of Ubuntu you are using, via 'lsb_release -rd' or System -> About Ubuntu
Broken in 18.04 and also in 20.10 (I guess it's also broken in anything inbetween)
> 2) The version of the package you are using, via 'apt-cache policy pkgname' or by checking in Software Center
libsasl2-
ldap-utils: 2.4.53+
libgssapi-krb5-2: 1.17-10ubuntu0.1
> 3) What you expected to happen
# kinit
$ export LDAPSASL_
$ ldapwhoami -O minssf=0,maxssf=0 -N -Y GSSAPI -H ldaps://<DC-fqdn>
SASL/GSSAPI authentication started
SASL username: <some-username>
SASL SSF: 0
u:<some-username>
> 4) What happened instead
SASL/GSSAPI authentication started
ldap_sasl_
additional info: 80090346: LdapErr: DSID-0C090597, comment: AcceptSecurityC
---------------
Microsoft ActiveDirectory has "LDAP Channel Binding" and recommends activating this as a required feature. See https:/
Authentication to any AD DC which has mandatory channel binding fails.
Channel binding requires at least an update to cyrus-sasl, which is not in any release as far as I can see:
https:/
It also needs this commit in openldap:
https:/
Which as far as I can tell is v2.5 (branch OPENLDAP_
RH also mentions it needs up-to-date krb5 libraries, but I can't tell what minimum version this needs.
I can build all libraries from source, current master (except for krb5 where I've used 1.18.3) and can confirm that channel binding works when using those libraries.
I'm not sure if Samba is affected, but at least adcli, ldap-utils, and I would guess by extension also SSSD and realmd.