.\" Automatically generated by Pod::Man 4.11 (Pod::Simple 3.35)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings. \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote. \*(C+ will
.\" give a nicer C++. Capital omega is used to do unbreakable dashes and
.\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
. ds -- \(*W-
. ds PI pi
. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
. ds L" ""
. ds R" ""
. ds C` ""
. ds C' ""
'br\}
.el\{\
. ds -- \|\(em\|
. ds PI \(*p
. ds L" ``
. ds R" ''
. ds C`
. ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD. Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
. if \nF \{\
. de IX
. tm Index:\\$1\t\\n%\t"\\$2"
..
. if !\nF==2 \{\
. nr % 0
. nr F 2
. \}
. \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "Authen::SASL::Perl::GSSAPI 3"
.TH Authen::SASL::Perl::GSSAPI 3 "2010-03-11" "perl v5.26.3" "User Contributed Perl Documentation"
.\" For nroff, turn off justification. Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
Authen::SASL::Perl::GSSAPI \- GSSAPI (Kerberosv5) Authentication class
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
.Vb 1
\& use Authen::SASL qw(Perl);
\&
\& $sasl = Authen::SASL\->new( mechanism => \*(AqGSSAPI\*(Aq );
\&
\& $sasl = Authen::SASL\->new( mechanism => \*(AqGSSAPI\*(Aq,
\& callback => { pass => $mycred });
\&
\& $sasl\->client_start( $service, $host );
.Ve
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
This method implements the client part of the \s-1GSSAPI SASL\s0 algorithm,
as described in \s-1RFC 2222\s0 section 7.2.1 resp. draft\-ietf\-sasl\-gssapi\-XX.txt.
.PP
With a valid Kerberos 5 credentials cache (aka \s-1TGT\s0) it allows
to connect to \fIservice\fR@\fIhost\fR given as the first two parameters
to Authen::SASL's \fBclient_start()\fR method. Alternatively, a GSSAPI::Cred
object can be passed in via the Authen::SASL callback hash using
the `pass' key.
.PP
Please note that this module does not currently implement a \s-1SASL\s0
security layer following authentication. Unless the connection is
protected by other means, such as \s-1TLS,\s0 it will be vulnerable to
man-in-the-middle attacks. If security layers are required, then the
Authen::SASL::XS \s-1GSSAPI\s0 module should be used instead.
.SS "\s-1CALLBACK\s0"
.IX Subsection "CALLBACK"
The callbacks used are:
.IP "authname" 4
.IX Item "authname"
The authorization identity to be used in \s-1SASL\s0 exchange
.IP "gssmech" 4
.IX Item "gssmech"
The \s-1GSS\s0 mechanism to be used in the connection
.IP "pass" 4
.IX Item "pass"
The \s-1GSS\s0 credentials to be used in the connection (optional)
.SH "EXAMPLE"
.IX Header "EXAMPLE"
.Vb 1
\& #! /usr/bin/perl \-w
\&
\& use strict;
\&
\& use Net::LDAP 0.33;
\& use Authen::SASL 2.10;
\&
\& # \-\-\-\-\-\-\-\- Adjust to your environment \-\-\-\-\-\-\-\-
\& my $adhost = \*(Aqtheserver.bla.net\*(Aq;
\& my $ldap_base = \*(Aqdc=bla,dc=net\*(Aq;
\& my $ldap_filter = \*(Aq(&(sAMAccountName=BLAAGROL))\*(Aq;
\&
\& my $sasl = Authen::SASL\->new(mechanism => \*(AqGSSAPI\*(Aq);
\& my $ldap;
\&
\& eval {
\& $ldap = Net::LDAP\->new($adhost,
\& onerror => \*(Aqdie\*(Aq)
\& or die "Cannot connect to LDAP host \*(Aq$adhost\*(Aq: \*(Aq$@\*(Aq";
\& $ldap\->bind(sasl => $sasl);
\& };
\&
\& if ($@) {
\& chomp $@;
\& die "\enBind error : $@",
\& "\enDetailed SASL error: ", $sasl\->error,
\& "\enTerminated";
\& }
\&
\& print "\enLDAP bind() succeeded, working in authenticated state";
\&
\& my $mesg = $ldap\->search(base => $ldap_base,
\& filter => $ldap_filter);
\&
\& # \-\-\-\-\-\-\-\- evaluate $mesg
.Ve
.SS "\s-1PROPERTIES\s0"
.IX Subsection "PROPERTIES"
The properties used are:
.IP "maxbuf" 4
.IX Item "maxbuf"
The maximum buffer size for receiving cipher text
.IP "minssf" 4
.IX Item "minssf"
The minimum \s-1SSF\s0 value that should be provided by the \s-1SASL\s0 security layer.
The default is 0
.IP "maxssf" 4
.IX Item "maxssf"
The maximum \s-1SSF\s0 value that should be provided by the \s-1SASL\s0 security layer.
The default is 2**31
.IP "externalssf" 4
.IX Item "externalssf"
The \s-1SSF\s0 value provided by an underlying external security layer.
The default is 0
.IP "ssf" 4
.IX Item "ssf"
The actual \s-1SSF\s0 value provided by the \s-1SASL\s0 security layer after the \s-1SASL\s0
authentication phase has been completed. This value is read-only and set
by the implementation after the \s-1SASL\s0 authentication phase has been completed.
.IP "maxout" 4
.IX Item "maxout"
The maximum plaintext buffer size for sending data to the peer.
This value is set by the implementation after the \s-1SASL\s0 authentication
phase has been completed and a \s-1SASL\s0 security layer is in effect.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
Authen::SASL,
Authen::SASL::Perl
.SH "AUTHORS"
.IX Header "AUTHORS"
Written by Simon Wilkinson, with patches and extensions by Achim Grolms
and Peter Marschall.
.PP
Please report any bugs, or post any suggestions, to the perl-ldap mailing list
<perl\-ldap@perl.org>
.SH "COPYRIGHT"
.IX Header "COPYRIGHT"
Copyright (c) 2006 Simon Wilkinson, Achim Grolms and Peter Marschall.
All rights reserved. This program is free software; you can redistribute
it and/or modify it under the same terms as Perl itself.