mirror/openldap
2
0
Fork 0
mirror of https://git.openldap.org/openldap/openldap.git synced 2024-12-15 03:01:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

ITS#6757 fix GSSAPI realm examples

Browse Source
This commit is contained in:
Howard Chu 2021-02-15 14:11:44 +00:00
parent 0b769a4490
commit 549d6a2ba2
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
doc/guide/admin/sasl.sdf
View File

@ -138,25 +138,35 @@ command option.
For the purposes of authentication and authorization, {{slapd}}(8)
associates an authentication request DN of the form:
> uid=<primary[/instance]>,cn=<realm>,cn=gssapi,cn=auth
> uid=<primary[/instance][@realm]>,cn=gssapi,cn=auth
The realm is omitted by Cyrus SASL if it's equal to the default realm of the
server in {{FILE:/etc/krb5.conf}}.
Continuing our example, a user with the Kerberos principal
{{EX:kurt@EXAMPLE.COM}} would have the associated DN:
> uid=kurt,cn=example.com,cn=gssapi,cn=auth
> uid=kurt,cn=gssapi,cn=auth
and the principal {{EX:ursula/admin@FOREIGN.REALM}} would have the
associated DN:
> uid=ursula/admin,cn=foreign.realm,cn=gssapi,cn=auth
> uid=ursula/admin@foreign.realm,cn=gssapi,cn=auth
The authentication request DN can be used directly ACLs and
The authentication request DN can be used directly in ACLs and
{{EX:groupOfNames}} "member" attributes, since it is of legitimate
LDAP DN format. Or alternatively, the authentication DN could be
mapped before use. See the section {{SECT:Mapping Authentication
Identities}} for details.
If you configure the {{olcSaslRealm}} then it will be inserted as
an extra component in the authorization DN, regardless of any
Kerberos realms in use. For example, if you set olcSaslRealm to
{{EX:example.com}} then you will get:
> uid=kurt,cn=example.com,cn=gssapi,cn=auth
> uid=ursula/admin@foreign.realm,cn=example.com,cn=gssapi,cn=auth
H3: KERBEROS_V4