ejabberd - Comments for "Authenticate Against SASL GSSAPI" https://www.ejabberd.im/cyrsasl_gssapi en Hi!Could you please tell me https://www.ejabberd.im/cyrsasl_gssapi#comment-58333 <p>Hi!</p> <p>Just for history: this error primarily means that something is wrong in full principal name, e.g. XMPP/im.domain.org@DOMAIN.ORG. In my case it was the service name (LOL, I even digged into the C code until found how it works).</p> <p>Good luck!</p> Fri, 17 Feb 2012 09:09:22 +0000 fk_ comment 58333 at https://www.ejabberd.im Hi, badlopI've successfully https://www.ejabberd.im/cyrsasl_gssapi#comment-58354 <p>Hi, badlop</p> <p>I've successfully modified former patch to support 2.1.9 but it is broken. It incorrectly manages sasl_ctx record avoiding gssapi initialize properly. I'm trying to backport gssapi stuff from 3.x ver. If you can help me with that please find me on conference at jabber.ru. My nick is ferimy. I'm sure that problem is quite simple and fix should not be complex but I'm weak in erlang sou your help is highly appreciated.<br /> Anyway, I'll look at this patch to see if it's correct.</p> <p>Update:<br /> at first look patch won't produce mechlist to client at all since it uses</p> <div class="codeblock"><code>-record(sasl_mechanism, {mechanism, module, password_type, require_plain_password}).</code></div> <p>so each module should return false as 3rd arg.</p> <p>Secondly, you forgot to include "realm" here</p> <div class="codeblock"><code>-record(state, {sasl,<br />+ needsmore=true,<br />+ step=0,<br />+ host,<br />+ authid,<br />+ authzid,<br />+ authrealm}).</code></div> <p>////<br /> Thanks!</p> Thu, 16 Feb 2012 12:29:55 +0000 fk_ comment 58354 at https://www.ejabberd.im Can you try this patch for https://www.ejabberd.im/cyrsasl_gssapi#comment-58349 <p>Can you try this patch for ejabberd 2.1.10, and comment if it works correctly or not?<br /> <noindex><a href="http://tkabber.jabber.ru/files/contributions/gssapi-2.1.10.diff" title="http://tkabber.jabber.ru/files/contributions/gssapi-2.1.10.diff" rel="nofollow" >http://tkabber.jabber.ru/files/contributions/gssapi-2.1.10.diff</a></noindex></p> Wed, 15 Feb 2012 13:06:08 +0000 mfoss comment 58349 at https://www.ejabberd.im I was able to get rid of this https://www.ejabberd.im/cyrsasl_gssapi#comment-58334 <p>I was able to get rid of this error after checking my host/domain names. If someone runs in this error please pay attention to the contents of /etc/resolv.conf, hostname and hosts file. They should NOT contain any error.<br /> Hope it help.</p> Tue, 14 Feb 2012 17:34:30 +0000 fk_ comment 58334 at https://www.ejabberd.im Hey https://www.ejabberd.im/cyrsasl_gssapi#comment-58329 <p>I've got exactly the same error after many hours spent integrating GSSAPI patches into the 2.1.9 .deb. I think that the var KRB5_KTNAME is not properly read from the environment so I'm currently debugging this issue. If someone can help to understand it such help would be highly appreciated.</p> Mon, 13 Feb 2012 09:54:25 +0000 fk_ comment 58329 at https://www.ejabberd.im I'm interested also. Please https://www.ejabberd.im/cyrsasl_gssapi#comment-58311 <p>I'm interested also. Please update the patch or, better, just include it into the mainstream. I'm trying to compile current version for ubuntu (2.1.9) with patch applied but still getting the error</p> <p>========================================================================================<br /> /usr/bin/erlc -W -DSSL40 -pa . cyrsasl_digest.erl<br /> /usr/bin/erlc -W -DSSL40 -pa . cyrsasl_gssapi.erl<br /> ./cyrsasl_gssapi.erl:83: argument mismatch for macro 'DEBUG'<br /> ./cyrsasl_gssapi.erl:93: argument mismatch for macro 'DEBUG'<br /> ./cyrsasl_gssapi.erl:120: argument mismatch for macro 'DEBUG'<br /> ./cyrsasl_gssapi.erl:128: argument mismatch for macro 'DEBUG'<br /> ./cyrsasl_gssapi.erl:46: function mech_new/1 undefined<br /> ./cyrsasl_gssapi.erl:88: function do_step/2 undefined<br /> ./cyrsasl_gssapi.erl:56: Warning: record state is unused<br /> make[1]: *** [cyrsasl_gssapi.beam] Error 1<br /> make[1]: Leaving directory `/home/user/prj/ejabberd/ejabberd-2.1.9/src'<br /> dh_auto_build: make -j1 returned exit code 2<br /> make: *** [build-stamp] Error 2<br /> dpkg-buildpackage: error: debian/rules build gave error exit status 2<br /> =====================================================================</p> <p>I have successfully made .deb for esasl with checkinstall, installed it but it seems that erlc is unable to find some deps...<br /> Did anybody have luck with that?</p> Wed, 01 Feb 2012 20:02:05 +0000 fk_ comment 58311 at https://www.ejabberd.im Hey, thanks for doing this https://www.ejabberd.im/cyrsasl_gssapi#comment-58234 <p>Hey,</p> <p>thanks for doing this patch. I'm curious why it hasn't been included in the standard ejabberd source for 2.1.x, does anyone know this?</p> <p>I'm currently figuring out how I could achieve OAuth2.0 authentication with ejabberd and it seems that there's a new ietf standard for OAuth2.0 over GSS-API.<br /> Does anyone know how this would work? Would this work without changes to the GSS-API-Patch?</p> <p>Thanks,</p> <p>- Michael</p> Sat, 14 Jan 2012 09:54:33 +0000 mweibel comment 58234 at https://www.ejabberd.im The error code 43 https://www.ejabberd.im/cyrsasl_gssapi#comment-57597 <p>I came across the same problem, and it was solved by changing the actual server hostname to match the xmpp/$FQDN in the keytab.</p> <p>The error code 43 was returned by call to gsasl_server_start() in esasl code, meaning GSASL_GSSAPI_ACQUIRE_CRED_ERROR (see <noindex><a href="http://original.jamesthornton.com/gnu/gsasl/Error-values.html" title="http://original.jamesthornton.com/gnu/gsasl/Error-values.html" rel="nofollow" >http://original.jamesthornton.com/gnu/gsasl/Error-values.html</a></noindex> and /usr/include/gsasl.h).</p> Fri, 15 Jul 2011 12:02:16 +0000 Juha Erkkilä comment 57597 at https://www.ejabberd.im New Pathc version https://www.ejabberd.im/cyrsasl_gssapi#comment-56817 <p>New patch version for ejabberd 2.1.5 from fedora project is present <noindex><a href="ftp://fr2.rpmfind.net/linux/fedora/development/rawhide/source/SRPMS/ejabberd-2.1.5-6.fc15.src.rpm" title="ftp://fr2.rpmfind.net/linux/fedora/development/rawhide/source/SRPMS/ejabberd-2.1.5-6.fc15.src.rpm" rel="nofollow" >ftp://fr2.rpmfind.net/linux/fedora/development/rawhide/source/SRPMS/ejab...</a></noindex> ejabberd-0009-Support-SASL-GSSAPI-authentication-thanks-to-Mikael-.patch</p> Wed, 17 Nov 2010 17:40:13 +0000 master_volkov comment 56817 at https://www.ejabberd.im I have improved the configure https://www.ejabberd.im/cyrsasl_gssapi#comment-55163 <p>I have improved the configure script on github: <noindex><a href="http://github.com/mikma/esasl" title="http://github.com/mikma/esasl" rel="nofollow" >http://github.com/mikma/esasl</a></noindex></p> <p>/Mikael</p> Sun, 17 Jan 2010 14:12:50 +0000 mikma comment 55163 at https://www.ejabberd.im Maybe you need to make https://www.ejabberd.im/cyrsasl_gssapi#comment-55141 <p>Maybe you need to make install ejabberd to make it work? I haven't installed it on my test machine until I've patched it (I "make configure" ejabberd port to cause it to download and unpack the tarball, then patched it, then issued "make install"). Maybe you need to "make deinstall &amp;&amp; make clean &amp;&amp; make install"? Or maybe just make clean the ejabberd port before recompiling the new beams?</p> Mon, 11 Jan 2010 23:44:35 +0000 mikekaganski comment 55141 at https://www.ejabberd.im Hi mikekaganski! Thank you https://www.ejabberd.im/cyrsasl_gssapi#comment-55138 <p>Hi mikekaganski!</p> <p>Thank you for your help. Installation worked. I had to change GSASL_LIBS in all Makefile, though. After installation and patching, i recompiled to new beam files and manually copied them to the erlang dir. My ejabberd then could not start properly so I had to revert to the old beam files. I will try to search for more clues.</p> <p>Thanks again!</p> Mon, 11 Jan 2010 19:23:11 +0000 sengwa comment 55138 at https://www.ejabberd.im Re: configure: error: You need the ei library https://www.ejabberd.im/cyrsasl_gssapi#comment-55098 <p>You need to tell the script where your libei.a is located (I have mine at /usr/local/lib/erlang/lib/erl_interface-3.6.4/lib/libei.a). So you need to add this switch to configure: -CPPFLAGS="-L/your/path/to/lib".<br /> You may also encounter some problems after successful configure, in the gmake phase. I had to modify the Makefile files that were made by configure script. To be specific, I had to tweak the esasl/c_src/Makefile to make the variable GSASL_LIBS to include that same string. Now I have that line look like this:<br /> GSASL_LIBS = -L/usr/local/lib -L/usr/local/lib/erlang/lib/erl_interface-3.6.4/lib -lgsasl<br /> Hope this helps.</p> <p>PS. Note to mikma: It would be nice if you could modify the configuration script so that the commands that make use of that GSASL_LIBS thing would also note the contents of the CPPFLAGS. Thank you for help.</p> Thu, 07 Jan 2010 05:35:56 +0000 mikekaganski comment 55098 at https://www.ejabberd.im configure: error: You need the ei library https://www.ejabberd.im/cyrsasl_gssapi#comment-55090 <p>Hi,</p> <p>This might be a little bit off topic. But I can't seem to install esasl-0.1. When I run configure --prefix=/usr, i get the error and the following logs:</p> <p>checking ei.h usability... yes<br /> checking ei.h presence... yes<br /> checking for ei.h... yes<br /> checking for ei_decode_version in -lei... no<br /> configure: error: You need the ei library</p> <p>my erlang library is in /usr/local/lib/erlang/lib. I use FreeBSD 7.2 and installed ejabberd<br /> form port created by <noindex><a href="http://fujibayashi.jp/2009/12/13/amusingly-enough-freebsd-and-ejabberd/" title="http://fujibayashi.jp/2009/12/13/amusingly-enough-freebsd-and-ejabberd/" rel="nofollow" >http://fujibayashi.jp/2009/12/13/amusingly-enough-freebsd-and-ejabberd/</a></noindex></p> <p>Hope you can shed a light on this.</p> <p>Thanks.</p> Tue, 29 Dec 2009 22:40:19 +0000 sengwa comment 55090 at https://www.ejabberd.im GSSAPI error https://www.ejabberd.im/cyrsasl_gssapi#comment-54978 <p>Hi all,</p> <p>thank you for your help, badlop. I've tried to use the patch with eJabberd 1.1.2 and run into another error. This time, eJabberd should have almost done it. The error says:</p> <div class="codeblock"><code>Error: GSSAPI error in server while negotiating security context in gss_init_sec_context() in SASL library.&nbsp; This is most likely due insufficient credentials or malicious interactions.<br />&lt;0.221.0&gt;: Result &lt;0.282.0&gt;: {error,{gsasl,40}}</code></div> <p>Has someone experienced this error before using eJabberd and GSSAPI?</p> <p>Thanks for your help.</p> <p>Oliver Smith</p> Wed, 02 Dec 2009 10:21:11 +0000 oliver.smith comment 54978 at https://www.ejabberd.im