E.3 Prerequisites for Configuring GSSAPI

To configure GSSAPI, you must first do the following:

  • SASL-GSSAPI method: Install the SASL-GSSAPI method. Refer to the Installing a Login Method section in the NetIQ Modular Authentication Services 3.3 Administration Guide.

    NOTE:The eDirectory SASL-GSSAPI method does not work on installations of Open Enterprise Server versions 2 or 11 that have Domain Services for Windows installed.

    To verify whether SASL-GSSAPI is installed on your machine, enter the following:

    ldapsearch -x -h osg-dt-srv9 -b " " -s base | grep -i sasl

    If SASL-GSSAPI is installed, the output of the command is similar to the following:

    supportedSASLMechanisms: NMAS_LOGIN
    supportedSASLMechanisms: GSSAPI

  • Key distribution center (KDC): Install Kerberos KDC (MIT; Active Directory) on the network.

    For Microsoft KDC (Active Directory), you must have the Kerberos tools installed. These tools are part of the Windows installation and can be installed from \support\tools\setup.exe (Windows XP) and \support\tools\suptools.msi (Windows 2003) on the Windows installation CD.

  • Time Synchronization: Synchronize the time on the NMAS client machine, the NMAS server machine, and the KDC machine for this method to work. For more information on synchronizing network time, refer to Synchronizing Network Time.

  • Kerberos LDAP Extensions: Add the Kerberos LDAP extensions. For more information, see Adding Kerberos LDAP Extensions.

    IMPORTANT:

    • On Open Enterprise Server, do not add the Kerberos LDAP extensions on servers where Domain Services for Windows or DNS services are configured.

    • All Kerberos information collected from your Kerberos administration is case-sensitive and must be specified exactly in the same case.

E.3.1 Assumptions on Network Characteristics

The SASL-GSSAPI mechanism is based on the following assumptions:

  • All the machines in the network have loosely synchronized time. This means that no two machines in the network have their system time differing by more than five minutes.

  • The SASL-GSSAPI mechanism is expected to be used mostly in LAN as it is difficult to obtain the time synchronization requirement mentioned above in MAN and/or WAN environments. However, this mechanism is not limited to LAN.

  • You trust the Kerberos servers and Kerberos administrators unconditionally and unverifiably.

  • Denial-of-Service attack is not countered. For more information, refer to RFC 1510.

E.3.2 Adding Kerberos LDAP Extensions

Kerberos LDAP Extensions provide the functionality to manage Kerberos keys.

To use the Kerberos LDAP extensions, you must install the LDAP libraries for C. For more information, refer to LDAP Libraries for C.

To add or remove the Kerberos LDAP extensions, use the krbLdapConfig utility. When standalone eDirectory package is extracted to a directory, the path of this file is extracted_folder/nmas/NmasMethods/Novell/GSSAPI/Kerberos_ldap_extensions/Linux/krbLdapConfig.

For example, /misc/eDir88/Linux/nmas/NmasMethods/Novell/GSSAPI/Kerberos_ldap_extensions/Linux/krbLdapConfig.

To add the Kerberos LDAP extensions, use the following syntax:

krbldapconfig {-i | -u} -D bind_DN [-w bind_DN_password] [-H ldap://[ldap host ip]:[ldap-port] [-e trusted_root_cert]

The following table explains the krbldapconfig utility parameters:

Parameter

Description

-i

Adds the Kerberos LDAP extensions to eDirectory.

-u

Removes the Kerberos LDAP extensions from eDirectory.

-D bind_fdn

Specifies the FDN of the administrator or the user with administrator-equivalent rights.

This must be in the format cn=admin,o=org.

-w bind_fdn_password

Specifies the password of the bind FDN (bind_fdn).

-h ldap_server

Specifies the hostname or IP address of the LDAP server where Kerberos LDAP extensions must be installed.

-p port

Specifies the port where the LDAP server is running.

-e trusted_root_file

Specifies the trusted root certificate filename for the SSL bind.

If you are using an SSL port, specify the -e option.

For more information, refer to Exporting the Trusted Root Certificate.

NOTE:If you do not specify the -h option, the name of the local host that krbldapconfig is invoked from is used as the default.

If you do not specify the LDAP server port and the trusted root certificate, the default port 389 is used.

If you do not specify the LDAP server port but specify the trusted root certificate, the default port 636 is used.

For example, enter the following to add the extensions:

krbldapconfig -i -D cn=admin,o=org -w password -h ldapserver -p 389

Or to remove, enter the following:

krbldapconfig -u -D cn=admin,o=org -w password -h ldapserver -p 389

IMPORTANT:You must manually refresh the LDAP server for the installation changes to take effect. For more information, refer to Refreshing the LDAP Server.

E.3.3 Exporting the Trusted Root Certificate

  1. On the Identity Console home page, click Certificate management tile > Trusted Root Management to open the Modify Object page.

  2. Click Trusted Roots tab, then select Trusted Root Certificate and view the details of the certificate.

  3. Click Export .

  4. Specify whether you want to export the private key or not. If you want to export the private key, you might need to specify a password to protect the private key.

  5. Click OK.

  6. Click Save the exported certificate.

  7. Click Save File.

  8. Click Close.