Re: problem with nss_ldap

On Tue, 10 Mar 2009, Doug Rabson wrote:

DR>
DR>On 6 Mar 2009, at 22:24, Kostik Belousov wrote:
DR>
DR>> On Fri, Mar 06, 2009 at 05:00:49PM -0500, tmclaugh_at_sdf.lonestar.org wrote:
DR>> > > On Fri, Mar 06, 2009 at 09:39:31PM +0100, Hartmut Brandt wrote:
DR>> > > > 
DR>> > > > Hi Tom,
DR>> > > > 
DR>> > > > On Sat, 28 Feb 2009, Tom McLaughlin wrote:
DR>> > > > 
DR>> > > > TM>Tom McLaughlin wrote:
DR>> > > > TM>> Harti Brandt wrote:
DR>> > > > TM>> > On Sun, 18 Jan 2009, Hartmut.Brandt_at_dlr.de wrote:
DR>> > > > TM>
DR>> > > > TM>> > > Both create entries in /var/log/messages like:
DR>> > > > TM>> > >
DR>> > > > TM>> > > Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error:
DR>> > > > Miscellaneous
DR>> > > > TM>> > > failure (see
DR>> > > > TM>> > >
DR>> > > > text)???????????????ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
DR>> > > > TM>Z
DR>> > > > TM>> Z
DR>> > > > TM>> >  ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ
DR>> > > > TM>> > > Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ
DR>> > > > TM>> > >
DR>> > > > TM>> > > I've tried to figure out in which of the dozens of layered
DR>> > > > libraries
DR>> > > > TM>> > > (gss, sasl, ssl, ......) this error is generated but did not
DR>> > > > find
DR>> > > > TM>> > > anything.
DR>> > > > TM>> > >
DR>> > > > TM>> > > This is on amd64, krb5 enabled in pam, gssapi disabled in
DR>> > > > sshd_config
DR>> > > > TM>> > > (as I said, this worked before).
DR>> > > > TM>> > So to answer my own mail: I made a link from the kerberos
DR>> > > > ticket
DR>> > > > file
DR>> > > > TM>> > which contains the host ticket (and is specified in
DR>> > > > nss_ldap.conf) to
DR>> > > > TM>> > /tmp/krb5cc_0. I've no idea why this is suddenly necessary,
DR>> > > > though.
DR>> > > > TM>>
DR>> > > > TM>> There may be an issue with the env method used in nss_ldap to
DR>> > > > change the
DR>> > > > TM>> credentials cache.  My mind is fuzzy but I do recall a similar
DR>> > > > issue but
DR>> > > > TM>> don't remember the exact cause or case.  nss_ldap has a second
DR>> > > > configurable
DR>> > > > TM>> ccname method which when I submitted the original patch I
DR>> > > > intended
DR>> > > > to
DR>> > > > TM>> switch to once we had a newer heimdal.  Once I get nss_ldap
DR>> > > > working
DR>> > > > on my
DR>> > > > TM>> box I intend to submit another patch.
DR>> > > > TM>>
DR>> > > > TM>> tom
DR>> > > > TM>
DR>> > > > TM>Hi Harti (CC maintainer),
DR>> > > > TM>
DR>> > > > TM>Can you try the attached patch for nss_ldap?  This should cause
DR>> > > > the
DR>> > > > host
DR>> > > > TM>ticket to work correctly on -CURRENT.  It's "my box approved".
DR>> > > > 
DR>> > > > Does not work. I rebuilt my system with today's sources to be sure,
DR>> > > > removed my patches to the two library makefiles and rebuilt nss_ldap
DR>> > > > with
DR>> > > > your patch. I get:
DR>> > > > 
DR>> > > > # ls -l
DR>> > > > dlopen: /usr/lib/libgssapi_spnego.so.10: Undefined symbol
DR>> > > > "GSS_C_NT_HOSTBASED_SERVICE"
DR>> > > > /libexec/ld-elf.so.1: /usr/lib/libgssapi_krb5.so.10: Undefined symbol
DR>> > > > "gss_oid_equal"
DR>> > > > 
DR>> > > > Basically on everything I enter. Luckily vi still works :-)
DR>> > > > 
DR>> > > > I saw that the configuration script claims not to find
DR>> > > > gss_krb5_ccache_name in -lgssapi or -lgssapi_krb5. This is because
DR>> > > > the
DR>> > > > test program for -lgssapi_krb5 links only to gssapi_krb5 but not to
DR>> > > > gssapi
DR>> > > > and so gets a lot of errors. I fixed this by adding gssapi, but the
DR>> > > > final
DR>> > > > result was the same.
DR>> > > 
DR>> > > It seems that this is because libgssapi_krb5, libgssapi_spnego
DR>> > > and several other heimdal shared libraries are not linked against
DR>> > > libgssapi.
DR>> > > 
DR>> > > 
DR>> > 
DR>> > As I understand it libgssapi_krb5 and libgssapi_spnego are not supposed
DR>> > to
DR>> > be linked against libgssapi.  They're supposed to be just plugins.
DR>> 
DR>> These objects reference symbols from libgssapi. The libgssapi or nss_ldap
DR>> are dlopened without RTLD_GLOBAL flag, and libgssapi-provided symbols
DR>> are not available. As I understand, nss module must be not loaded with
DR>> RTLD_GLOBAL.
DR>> 
DR>> Our binutils in base are old. Newer ld has a switch
DR>> --no-allow-shlib-undefined
DR>> that fails the link if shared library has undefined references. I find
DR>> it useful to catch and fix this kind of errors.
DR>
DR>
DR>The real problem is that nss_ldap should not link with libgssapi_krb5
DR>directly. This library is a plugin for the mechanism-independant libgssapi
DR>and can not be used standalone. The nss_ldap module should link to libgssapi
DR>and that will handle loading libgssapi_krb5 as necessary.

Is it possible that gssapi_krb5 is needed because nss_ldap needs to set 
the ticket cache name for the host ticket from the krb5_ccname statement?

Just a guess, though?

harti