https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c Leonardo Chiquitto changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium Status|NEW |ASSIGNED CC| |lchiquitto@suse.com Component|Kernel |Basesystem AssignedTo|kernel-maintainers@forge.pr |lchiquitto@suse.com |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c3 Ralf Haferkamp changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED CC| |rhafer@suse.com InfoProvider|rhafer@suse.com | --- Comment #3 from Ralf Haferkamp 2012-08-10 09:54:44 CEST --- (In reply to comment #2)

Ralf, rings any bell? No :(

I'm wondering if something changed in cyrus-sasl We updated to 2.1.25 with 12.2

that could explain why the "mutual-authentication-required" seems to no longer be set by default. As the ldapsearch command with GSSAPI still seems to work I don't think anything changed in that regard. Might the be a permissions problem (just a wild guess: like the automout ldap tool not being able to access the user's tickets or something?)

-- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c7 Leonardo Chiquitto changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |joschibrauchle@gmx.de --- Comment #7 from Leonardo Chiquitto 2012-08-10 12:43:06 UTC --- Joschi, thanks for isolating the problem!

Hence, I believe that autofs is missing to correctly request the use a security layer!

I wonder if this isn't something that can be set in a configuration file. Some things I would try (shotgun approach :)): 1. Add usetls to /etc/autofs_ldap_auth.conf: 2. Enable GSSAPI_ENCRYPT in the LDAP client library (/etc/openldap/ldap.conf): GSSAPI_ENCRYPT on Any of these make some difference? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c9 --- Comment #9 from Joschi Brauchle 2012-08-10 14:22:39 UTC --- Also tried turning on all sasl_secprops in /etc/ldap.conf: --------- sasl_secprops maxssf=256,minssf=128,forwardsec,passcred --------- but no change. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c11 --- Comment #11 from Leonardo Chiquitto 2012-08-10 20:15:52 UTC --- Joschi, just to be absolutely sure that patch (and the mutual_req bit) is really the culprit, I've built a cyrus-sasl package for 12.1 with that change reverted. It should be available in the repository below in a couple of hours (OBS is slow to publish :/). I'd appreciate if you could verify. http://download.opensuse.org/repositories/home:/leonardocf:/branches:/openSU... -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c13 Leonardo Chiquitto changed: What |Removed |Added ---------------------------------------------------------------------------- InfoProvider|joschibrauchle@gmx.de |rhafer@suse.com --- Comment #13 from Leonardo Chiquitto 2012-08-13 19:51:28 UTC --- I've found an upstream bug about this problem: http://bugzilla.cyrusimap.org/bugzilla3/show_bug.cgi?id=3480 There's also a report against Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=628525 Debian reverted the change in cyrus-sasl with the following patch: https://bugzilla.cyrusimap.org/attachment.cgi?id=1393 Ralf, should we do the same in our package? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c15 --- Comment #15 from Leonardo Chiquitto 2012-08-21 02:03:00 UTC --- So far, no word from the cyrus-sasl upstream developers. Ralf, do you know if it's possible to fix it in the application (automount in this case)? I don't understand very well the interactions between all these libs (sasl, gssapi, ldap), but I'm wondering if there's a call or maybe an initialization option that could trigger the setting of the right flags in SASL. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c Leonardo Chiquitto changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |http://bugzilla.cyrusimap.o | |rg/bugzilla3/show_bug.cgi?i | |d=3480 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c17 --- Comment #17 from Leonardo Chiquitto 2012-08-28 16:20:27 UTC --- It may have the same cause. Could you test the packages in comment #11? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c19 Joschi Brauchle changed: What |Removed |Added ---------------------------------------------------------------------------- Component|Basesystem |Basesystem Version|RC 2 |12.3 Beta 1 AssignedTo|rhafer@suse.com |bnc-team-screening@forge.pr | |ovo.novell.com Product|openSUSE 12.2 |openSUSE Factory --- Comment #19 from Joschi Brauchle 2013-01-22 10:08:27 UTC --- So it looks like this problem still exists in 12.3 Beta 1. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c21 --- Comment #21 from Leonardo Chiquitto 2013-01-22 23:06:16 UTC --- Debian still ships with the change reverted, Fedora doesn't revert it (probably affected by the problem too). Ralf, what do you think? There are lots of changes in the gssapi plugin on the new cyrus-sasl release, but no change to that part of the code. Not sure if it's worth testing it. Do you think we could revert the change to fix this bug on 12.3? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c23 Ralf Haferkamp changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |varkoly@suse.com AssignedTo|rhafer@suse.com |ckornacker@suse.com --- Comment #23 from Ralf Haferkamp 2013-10-21 10:32:31 CEST --- Reassigning to new cyrus-sasl maintainer(s). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=775279 https://bugzilla.novell.com/show_bug.cgi?id=775279#c25 --- Comment #25 from Christian Kornacker 2014-06-13 10:19:26 UTC --- Since this affects more and more clients, and there's no progress upstream, I'm going to revert the patch. Apparently, Fedora and Debian are doing the same. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.