Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help
Authen::SASL::Perl::GSUser(Contributed Perl DocumAuthen::SASL::Perl::GSSAPI(3)

NAME
       Authen::SASL::Perl::GSSAPI - GSSAPI (Kerberosv5)	Authentication class

SYNOPSIS
	 use Authen::SASL qw(Perl);

	 $sasl = Authen::SASL->new( mechanism => 'GSSAPI' );

	 $sasl = Authen::SASL->new( mechanism => 'GSSAPI',
				    callback =>	{ pass => $mycred });

	 $sasl->client_start( $service,	$host );

DESCRIPTION
       This method implements the client part of the GSSAPI SASL algorithm, as
       described in RFC	2222 section 7.2.1 resp.
       draft-ietf-sasl-gssapi-XX.txt.

       With a valid Kerberos 5 credentials cache (aka TGT) it allows to
       connect to service@host given as	the first two parameters to
       Authen::SASL's client_start() method.  Alternatively, a GSSAPI::Cred
       object can be passed in via the Authen::SASL callback hash using	the
       `pass' key.

       Please note that	this module does not currently implement a SASL
       security	layer following	authentication.	Unless the connection is
       protected by other means, such as TLS, it will be vulnerable to man-in-
       the-middle attacks. If security layers are required, then the
       Authen::SASL::XS	GSSAPI module should be	used instead.

   CALLBACK
       The callbacks used are:

       authname
	   The authorization identity to be used in SASL exchange

       gssmech
	   The GSS mechanism to	be used	in the connection

       pass
	   The GSS credentials to be used in the connection (optional)

EXAMPLE
	#! /usr/bin/perl -w

	use strict;

	use Net::LDAP 0.33;
	use Authen::SASL 2.10;

	# -------- Adjust to your environment --------
	my $adhost	= 'theserver.bla.net';
	my $ldap_base	= 'dc=bla,dc=net';
	my $ldap_filter	= '(&(sAMAccountName=BLAAGROL))';

	my $sasl = Authen::SASL->new(mechanism => 'GSSAPI');
	my $ldap;

	eval {
	    $ldap = Net::LDAP->new($adhost,
				   onerror => 'die')
	      or  die "Cannot connect to LDAP host '$adhost': '$@'";
	    $ldap->bind(sasl =>	$sasl);
	};

	if ($@)	{
	    chomp $@;
	    die	  "\nBind error		: $@",
		  "\nDetailed SASL error: ", $sasl->error,
		  "\nTerminated";
	}

	print "\nLDAP bind() succeeded,	working	in authenticated state";

	my $mesg = $ldap->search(base	=> $ldap_base,
				 filter	=> $ldap_filter);

	# -------- evaluate $mesg

   PROPERTIES
       The properties used are:

       maxbuf
	   The maximum buffer size for receiving cipher	text

       minssf
	   The minimum SSF value that should be	provided by the	SASL security
	   layer.  The default is 0

       maxssf
	   The maximum SSF value that should be	provided by the	SASL security
	   layer.  The default is 2**31

       externalssf
	   The SSF value provided by an	underlying external security layer.
	   The default is 0

       ssf The actual SSF value	provided by the	SASL security layer after the
	   SASL	authentication phase has been completed. This value is read-
	   only	and set	by the implementation after the	SASL authentication
	   phase has been completed.

       maxout
	   The maximum plaintext buffer	size for sending data to the peer.
	   This	value is set by	the implementation after the SASL
	   authentication phase	has been completed and a SASL security layer
	   is in effect.

SEE ALSO
       Authen::SASL, Authen::SASL::Perl

AUTHORS
       Written by Simon	Wilkinson, with	patches	and extensions by Achim	Grolms
       and Peter Marschall.

       Please report any bugs, or post any suggestions,	to the perl-ldap
       mailing list <perl-ldap@perl.org>

COPYRIGHT
       Copyright (c) 2006 Simon	Wilkinson, Achim Grolms	and Peter Marschall.
       All rights reserved. This program is free software; you can
       redistribute it and/or modify it	under the same terms as	Perl itself.

perl v5.24.1			  2010-03-11	 Authen::SASL::Perl::GSSAPI(3)

NAME | SYNOPSIS | DESCRIPTION | EXAMPLE | SEE ALSO | AUTHORS | COPYRIGHT

Want to link to this manual page? Use this URL:
<https://www.freebsd.org/cgi/man.cgi?query=Authen::SASL::Perl::GSSAPI&sektion=3&manpath=FreeBSD+12.0-RELEASE+and+Ports>

home | help