ldapsearch and kerberos authentication The 2019 Stack Overflow Developer Survey Results Are InProblems set-up Single Sign-On using Kerberos authenticationKerberos + Ldap Setup not working with sshPutty Kerberos/GSSAPI authenticationObtain krb ticket for another userOpenSSH two factor authentication combined with Kerberos / public keyKerberos PuTTY from non-domain machine via VPNLDAP Kerberos authentication on linuxCan ssh generate a kerberos ticket? (FreeBSD)Using resources in foreign Kerberos Realm from windows without cross-domain trust?Cross-Realm-Trust between Active Directory and MIT Kerberos
I see my dog run
JSON.serialize: is it possible to suppress null values of a map?
Monty Hall variation
How long do I have to send payment?
Does it makes sense to buy a new cycle to learn riding?
Can I write a for loop that iterates over both collections and arrays?
"To split hairs" vs "To be pedantic"
Does light intensity oscillate really fast since it is a wave?
On the insanity of kings as an argument against Monarchy
Polarization lost upon 2nd reflection?
Can we apply L'Hospital's rule where the derivative is not continuous?
Is there a name of the flying bionic bird?
Carnot-Caratheodory metric
Does duplicating a spell with wish count as casting that spell?
What is this 4-propeller plane?
Which Sci-Fi work first showed weapon of galactic-scale mass destruction?
Inflated grade on resume at previous job, might former employer tell new employer?
Why can Shazam do this?
"What time...?" or "At what time...?" - what is more grammatically correct?
Is three citations per paragraph excessive for undergraduate research paper?
Output the Arecibo Message
Why do UK politicians seemingly ignore opinion polls on Brexit?
What tool would a Roman-age civilisation use to reduce/breakup silver and other metals?
I looked up a future colleague on linkedin before I started a job. I told my colleague about it and he seemed surprised. Should I apologize?
ldapsearch and kerberos authentication
The 2019 Stack Overflow Developer Survey Results Are InProblems set-up Single Sign-On using Kerberos authenticationKerberos + Ldap Setup not working with sshPutty Kerberos/GSSAPI authenticationObtain krb ticket for another userOpenSSH two factor authentication combined with Kerberos / public keyKerberos PuTTY from non-domain machine via VPNLDAP Kerberos authentication on linuxCan ssh generate a kerberos ticket? (FreeBSD)Using resources in foreign Kerberos Realm from windows without cross-domain trust?Cross-Realm-Trust between Active Directory and MIT Kerberos
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I can successfully connect and search to an Active Directory domain controller using ldapsearch. I am using the -x option, to specify a username/password authentication (password being specified by -W and username by -D).
I currently need to dump directory from a MIT-kerberos domain. Kerberos is the only protocol available for authentication. I can retrieve a kerberos TGT ticket with kinit. I am using these command lines:
ldapsearch -Y SASL -b "REALM.INC" -H ldap://kerberos_IP_address
-> ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available: No worthy mechs found
ldapsearch -o "mech=GSSAPI" ...
-> Invalid general option name: mech
How can I authenticate with kerberos using ldapsearch?
Many thanks for your help&replies
debian kerberos
asked Apr 20 '17 at 9:46
philippephilippe
1,23022141
add a comment |
I can successfully connect and search to an Active Directory domain controller using ldapsearch. I am using the -x option, to specify a username/password authentication (password being specified by -W and username by -D).
I currently need to dump directory from a MIT-kerberos domain. Kerberos is the only protocol available for authentication. I can retrieve a kerberos TGT ticket with kinit. I am using these command lines:
ldapsearch -Y SASL -b "REALM.INC" -H ldap://kerberos_IP_address
-> ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available: No worthy mechs found
ldapsearch -o "mech=GSSAPI" ...
-> Invalid general option name: mech
How can I authenticate with kerberos using ldapsearch?
Many thanks for your help&replies
debian kerberos
asked Apr 20 '17 at 9:46
philippephilippe
1,23022141
What happened when you do ldapsearch -H ldap://kerberos_IP_address -U administrator -s base -b "CN=Users,DC=domain,DC=com" -Y GSSAPI -s sub "(cn=*)" ? Does klist show valid tickets in cache ?
– Abey
Apr 20 '17 at 16:21
add a comment |
I can successfully connect and search to an Active Directory domain controller using ldapsearch. I am using the -x option, to specify a username/password authentication (password being specified by -W and username by -D).
I currently need to dump directory from a MIT-kerberos domain. Kerberos is the only protocol available for authentication. I can retrieve a kerberos TGT ticket with kinit. I am using these command lines:
ldapsearch -Y SASL -b "REALM.INC" -H ldap://kerberos_IP_address
-> ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available: No worthy mechs found
ldapsearch -o "mech=GSSAPI" ...
-> Invalid general option name: mech
How can I authenticate with kerberos using ldapsearch?
Many thanks for your help&replies
debian kerberos
asked Apr 20 '17 at 9:46
philippephilippe
1,23022141
I can successfully connect and search to an Active Directory domain controller using ldapsearch. I am using the -x option, to specify a username/password authentication (password being specified by -W and username by -D).
I currently need to dump directory from a MIT-kerberos domain. Kerberos is the only protocol available for authentication. I can retrieve a kerberos TGT ticket with kinit. I am using these command lines:
ldapsearch -Y SASL -b "REALM.INC" -H ldap://kerberos_IP_address
-> ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available: No worthy mechs found
ldapsearch -o "mech=GSSAPI" ...
-> Invalid general option name: mech
How can I authenticate with kerberos using ldapsearch?
Many thanks for your help&replies
debian kerberos
debian kerberos
asked Apr 20 '17 at 9:46
philippephilippe
1,23022141
asked Apr 20 '17 at 9:46
philippephilippe
1,23022141
asked Apr 20 '17 at 9:46
philippephilippe
1,23022141
asked Apr 20 '17 at 9:46
philippephilippe
1,23022141
asked Apr 20 '17 at 9:46
philippephilippe
1,23022141
1,23022141
What happened when you do ldapsearch -H ldap://kerberos_IP_address -U administrator -s base -b "CN=Users,DC=domain,DC=com" -Y GSSAPI -s sub "(cn=*)" ? Does klist show valid tickets in cache ?
– Abey
Apr 20 '17 at 16:21
add a comment |
What happened when you do ldapsearch -H ldap://kerberos_IP_address -U administrator -s base -b "CN=Users,DC=domain,DC=com" -Y GSSAPI -s sub "(cn=*)" ? Does klist show valid tickets in cache ?
– Abey
Apr 20 '17 at 16:21
What happened when you do ldapsearch -H ldap://kerberos_IP_address -U administrator -s base -b "CN=Users,DC=domain,DC=com" -Y GSSAPI -s sub "(cn=*)" ? Does klist show valid tickets in cache ?
– Abey
Apr 20 '17 at 16:21
What happened when you do ldapsearch -H ldap://kerberos_IP_address -U administrator -s base -b "CN=Users,DC=domain,DC=com" -Y GSSAPI -s sub "(cn=*)" ? Does klist show valid tickets in cache ?
– Abey
Apr 20 '17 at 16:21
add a comment |
2 Answers
2
active
oldest
votes
-Y is used to specify the SASL mechanism, which will probably be GSSAPI, though could be GSS-SPNEGO. Also, base dn must be in dn syntax (i.e., dc=example,dc=com), not domain syntax (example.com).
$ ldapsearch -x -b '' -s base supportedSASLMechanisms -H ldap://192.0.2.1/
dn:
supportedSASLMechanisms: GSSAPI
$ ldapsearch -Y GSSAPI -b dc=example,dc=com -H ldap://192.0.2.1/
$ ldapsearch -x -b '' -s base supportedSASLMechanisms -H ldap://192.0.2.2/
dn:
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: GSSAPI
edited Apr 5 at 16:45
Jonathon Reinhart
1561115
answered Apr 20 '17 at 21:17
8410484104
10.4k43168
add a comment |
depending on your ldapsearch & OS version, you can try to first authenticate to kerberos using kinit and "cache" your ticket, use it in a kerberos env variable, and then let ldapsearch use this variable, with something like this :
kinit -c /tmp/<yourlogin>.cc.tmp <yourlogin>
export KRB5CCNAME=/tmp/<yourlogin>.cc.tmp
ldapsearch -Tx -h <host> -p <port> -Y GSSAPI -b "dc=example,dc=com" cn=*
answered Apr 20 '17 at 22:10
oliviergolivierg
382314
-Tmeans something different to debian / OpenLDAP than it does to Solaris.
– 84104
Apr 20 '17 at 22:27
my commands run perfectly on a Linux RHEL 6.x, didn't try on debian tho, but it should work anyway assuming that the variable is set and the -Y is passed i suppose, thanks for the info btw
– olivierg
Apr 20 '17 at 22:35
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f845470%2fldapsearch-and-kerberos-authentication%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
-Y is used to specify the SASL mechanism, which will probably be GSSAPI, though could be GSS-SPNEGO. Also, base dn must be in dn syntax (i.e., dc=example,dc=com), not domain syntax (example.com).
$ ldapsearch -x -b '' -s base supportedSASLMechanisms -H ldap://192.0.2.1/
dn:
supportedSASLMechanisms: GSSAPI
$ ldapsearch -Y GSSAPI -b dc=example,dc=com -H ldap://192.0.2.1/
$ ldapsearch -x -b '' -s base supportedSASLMechanisms -H ldap://192.0.2.2/
dn:
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: GSSAPI
edited Apr 5 at 16:45
Jonathon Reinhart
1561115
answered Apr 20 '17 at 21:17
8410484104
10.4k43168
add a comment |
-Y is used to specify the SASL mechanism, which will probably be GSSAPI, though could be GSS-SPNEGO. Also, base dn must be in dn syntax (i.e., dc=example,dc=com), not domain syntax (example.com).
$ ldapsearch -x -b '' -s base supportedSASLMechanisms -H ldap://192.0.2.1/
dn:
supportedSASLMechanisms: GSSAPI
$ ldapsearch -Y GSSAPI -b dc=example,dc=com -H ldap://192.0.2.1/
$ ldapsearch -x -b '' -s base supportedSASLMechanisms -H ldap://192.0.2.2/
dn:
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: GSSAPI
edited Apr 5 at 16:45
Jonathon Reinhart
1561115
answered Apr 20 '17 at 21:17
8410484104
10.4k43168
add a comment |
-Y is used to specify the SASL mechanism, which will probably be GSSAPI, though could be GSS-SPNEGO. Also, base dn must be in dn syntax (i.e., dc=example,dc=com), not domain syntax (example.com).
$ ldapsearch -x -b '' -s base supportedSASLMechanisms -H ldap://192.0.2.1/
dn:
supportedSASLMechanisms: GSSAPI
$ ldapsearch -Y GSSAPI -b dc=example,dc=com -H ldap://192.0.2.1/
$ ldapsearch -x -b '' -s base supportedSASLMechanisms -H ldap://192.0.2.2/
dn:
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: GSSAPI
edited Apr 5 at 16:45
Jonathon Reinhart
1561115
answered Apr 20 '17 at 21:17
8410484104
10.4k43168
-Y is used to specify the SASL mechanism, which will probably be GSSAPI, though could be GSS-SPNEGO. Also, base dn must be in dn syntax (i.e., dc=example,dc=com), not domain syntax (example.com).
$ ldapsearch -x -b '' -s base supportedSASLMechanisms -H ldap://192.0.2.1/
dn:
supportedSASLMechanisms: GSSAPI
$ ldapsearch -Y GSSAPI -b dc=example,dc=com -H ldap://192.0.2.1/
$ ldapsearch -x -b '' -s base supportedSASLMechanisms -H ldap://192.0.2.2/
dn:
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: GSSAPI
edited Apr 5 at 16:45
Jonathon Reinhart
1561115
answered Apr 20 '17 at 21:17
8410484104
10.4k43168
edited Apr 5 at 16:45
Jonathon Reinhart
1561115
edited Apr 5 at 16:45
Jonathon Reinhart
1561115
edited Apr 5 at 16:45
Jonathon Reinhart
1561115
1561115
answered Apr 20 '17 at 21:17
8410484104
10.4k43168
answered Apr 20 '17 at 21:17
8410484104
10.4k43168
answered Apr 20 '17 at 21:17
8410484104
10.4k43168
10.4k43168
add a comment |
add a comment |
depending on your ldapsearch & OS version, you can try to first authenticate to kerberos using kinit and "cache" your ticket, use it in a kerberos env variable, and then let ldapsearch use this variable, with something like this :
kinit -c /tmp/<yourlogin>.cc.tmp <yourlogin>
export KRB5CCNAME=/tmp/<yourlogin>.cc.tmp
ldapsearch -Tx -h <host> -p <port> -Y GSSAPI -b "dc=example,dc=com" cn=*
answered Apr 20 '17 at 22:10
oliviergolivierg
382314
-Tmeans something different to debian / OpenLDAP than it does to Solaris.
– 84104
Apr 20 '17 at 22:27
my commands run perfectly on a Linux RHEL 6.x, didn't try on debian tho, but it should work anyway assuming that the variable is set and the -Y is passed i suppose, thanks for the info btw
– olivierg
Apr 20 '17 at 22:35
add a comment |
depending on your ldapsearch & OS version, you can try to first authenticate to kerberos using kinit and "cache" your ticket, use it in a kerberos env variable, and then let ldapsearch use this variable, with something like this :
kinit -c /tmp/<yourlogin>.cc.tmp <yourlogin>
export KRB5CCNAME=/tmp/<yourlogin>.cc.tmp
ldapsearch -Tx -h <host> -p <port> -Y GSSAPI -b "dc=example,dc=com" cn=*
answered Apr 20 '17 at 22:10
oliviergolivierg
382314
-Tmeans something different to debian / OpenLDAP than it does to Solaris.
– 84104
Apr 20 '17 at 22:27
my commands run perfectly on a Linux RHEL 6.x, didn't try on debian tho, but it should work anyway assuming that the variable is set and the -Y is passed i suppose, thanks for the info btw
– olivierg
Apr 20 '17 at 22:35
add a comment |
depending on your ldapsearch & OS version, you can try to first authenticate to kerberos using kinit and "cache" your ticket, use it in a kerberos env variable, and then let ldapsearch use this variable, with something like this :
kinit -c /tmp/<yourlogin>.cc.tmp <yourlogin>
export KRB5CCNAME=/tmp/<yourlogin>.cc.tmp
ldapsearch -Tx -h <host> -p <port> -Y GSSAPI -b "dc=example,dc=com" cn=*
answered Apr 20 '17 at 22:10
oliviergolivierg
382314
depending on your ldapsearch & OS version, you can try to first authenticate to kerberos using kinit and "cache" your ticket, use it in a kerberos env variable, and then let ldapsearch use this variable, with something like this :
kinit -c /tmp/<yourlogin>.cc.tmp <yourlogin>
export KRB5CCNAME=/tmp/<yourlogin>.cc.tmp
ldapsearch -Tx -h <host> -p <port> -Y GSSAPI -b "dc=example,dc=com" cn=*
answered Apr 20 '17 at 22:10
oliviergolivierg
382314
answered Apr 20 '17 at 22:10
oliviergolivierg
382314
answered Apr 20 '17 at 22:10
oliviergolivierg
382314
answered Apr 20 '17 at 22:10
oliviergolivierg
382314
382314
-Tmeans something different to debian / OpenLDAP than it does to Solaris.
– 84104
Apr 20 '17 at 22:27
my commands run perfectly on a Linux RHEL 6.x, didn't try on debian tho, but it should work anyway assuming that the variable is set and the -Y is passed i suppose, thanks for the info btw
– olivierg
Apr 20 '17 at 22:35
add a comment |
-Tmeans something different to debian / OpenLDAP than it does to Solaris.
– 84104
Apr 20 '17 at 22:27
my commands run perfectly on a Linux RHEL 6.x, didn't try on debian tho, but it should work anyway assuming that the variable is set and the -Y is passed i suppose, thanks for the info btw
– olivierg
Apr 20 '17 at 22:35
-T means something different to debian / OpenLDAP than it does to Solaris.– 84104
Apr 20 '17 at 22:27
-T means something different to debian / OpenLDAP than it does to Solaris.– 84104
Apr 20 '17 at 22:27
my commands run perfectly on a Linux RHEL 6.x, didn't try on debian tho, but it should work anyway assuming that the variable is set and the -Y is passed i suppose, thanks for the info btw
– olivierg
Apr 20 '17 at 22:35
my commands run perfectly on a Linux RHEL 6.x, didn't try on debian tho, but it should work anyway assuming that the variable is set and the -Y is passed i suppose, thanks for the info btw
– olivierg
Apr 20 '17 at 22:35
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f845470%2fldapsearch-and-kerberos-authentication%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What happened when you do ldapsearch -H ldap://kerberos_IP_address -U administrator -s base -b "CN=Users,DC=domain,DC=com" -Y GSSAPI -s sub "(cn=*)" ? Does klist show valid tickets in cache ?
– Abey
Apr 20 '17 at 16:21