Authen...GSSAPI(3pm) User Contributed Perl Documentation Authen...GSSAPI(3pm)
NAME
Authen::SASL::Perl::GSSAPI - GSSAPI (Kerberosv5) Authentication class
VERSION
version 2.1700
SYNOPSIS
use Authen::SASL qw(Perl);
$sasl = Authen::SASL->new( mechanism => 'GSSAPI' );
$sasl = Authen::SASL->new( mechanism => 'GSSAPI',
callback => { pass => $mycred });
$sasl->client_start( $service, $host );
DESCRIPTION
This method implements the client part of the GSSAPI SASL algorithm, as
described in RFC 2222 section 7.2.1 resp. draft-ietf-sasl-gssapi-XX.txt.
With a valid Kerberos 5 credentials cache (aka TGT) it allows to connect
to service@host given as the first two parameters to Authen::SASL's
client_start() method. Alternatively, a GSSAPI::Cred object can be
passed in via the Authen::SASL callback hash using the `pass' key.
Please note that this module does not currently implement a SASL
security layer following authentication. Unless the connection is
protected by other means, such as TLS, it will be vulnerable to man-in-
the-middle attacks. If security layers are required, then the
Authen::SASL::XS GSSAPI module should be used instead.
CALLBACK
The callbacks used are:
authname
The authorization identity to be used in SASL exchange
gssmech
The GSS mechanism to be used in the connection
pass
The GSS credentials to be used in the connection (optional)
EXAMPLE
#! /usr/bin/perl -w
use strict;
use warnings;
use Net::LDAP 0.33;
use Authen::SASL 2.10;
# -------- Adjust to your environment --------
my $adhost = 'theserver.bla.net';
my $ldap_base = 'dc=bla,dc=net';
my $ldap_filter = '(&(sAMAccountName=BLAAGROL))';
my $sasl = Authen::SASL->new(mechanism => 'GSSAPI');
my $ldap;
eval {
$ldap = Net::LDAP->new($adhost,
onerror => 'die')
or die "Cannot connect to LDAP host '$adhost': '$@'";
$ldap->bind(sasl => $sasl);
};
if ($@) {
chomp $@;
die "\nBind error : $@",
"\nDetailed SASL error: ", $sasl->error,
"\nTerminated";
}
print "\nLDAP bind() succeeded, working in authenticated state";
my $mesg = $ldap->search(base => $ldap_base,
filter => $ldap_filter);
# -------- evaluate $mesg
PROPERTIES
The properties used are:
maxbuf
The maximum buffer size for receiving cipher text
minssf
The minimum SSF value that should be provided by the SASL security
layer. The default is 0
maxssf
The maximum SSF value that should be provided by the SASL security
layer. The default is 2**31
externalssf
The SSF value provided by an underlying external security layer.
The default is 0
ssf The actual SSF value provided by the SASL security layer after the
SASL authentication phase has been completed. This value is read-
only and set by the implementation after the SASL authentication
phase has been completed.
maxout
The maximum plaintext buffer size for sending data to the peer.
This value is set by the implementation after the SASL
authentication phase has been completed and a SASL security layer is
in effect.
SEE ALSO
Authen::SASL, Authen::SASL::Perl
AUTHORS
Written by Simon Wilkinson, with patches and extensions by Achim Grolms
and Peter Marschall.
Please report any bugs, or post any suggestions, to the perl-ldap
mailing list <perl-ldap@perl.org>
COPYRIGHT
Copyright (c) 2006 Simon Wilkinson, Achim Grolms and Peter Marschall.
All rights reserved. This program is free software; you can redistribute
it and/or modify it under the same terms as Perl itself.
perl v5.36.0 2023-09-24 Authen...GSSAPI(3pm)
Generated by dwww version 1.16 on Tue Dec 16 06:54:10 CET 2025.