saslauthd and multiple mechs

[Mike Culbertson]

John,

Very much appreciated but I think we're doing OK using PAM for now.  
What we did was just point saslauthd at pam, and have PAM perform auth  
against several backend systems.  All of the auth in our case is coming 
through slapd, so the PAM service requested by saslauthd is always 
'ldap'.  This allowed us to configure PAM for saslauthd without 
otherwise messing with the rest of our PAM config.  Our /etc/pam.d/ldap 
looks like this:

<snip>
# Note that we only set up 'auth' here, no password/session/etc.

# This tries KRB5 first, using the system-wide settings
auth    sufficient      pam_krb5.so ignore_root
# Next we try KRB5 again, but with a non-default realm because some of 
our users are not in OTHERREALM.COM
auth    sufficient      pam_krb5.so ignore_root use_first_pass 
realm=OTHERREALM.COM
# lastly, try pam_ldap
auth    sufficient      pam_ldap.so use_first_pass
</snip>

I'd still prefer to have saslauthd handle this, but thankfully with the 
flexibility of pam_krb5 and pam_ldap, we're able to use PAM for 
slapd+saslauthd without interfering with anything else in the system, 
and it's actually working great so far. saslauthd+PAM may end up being 
an advantage for us rather than a workaround.

- Mike

On 06/17/2010 04:46 PM, John Newbigin wrote:
> The the best of my knowledge it is not supported.  I wrote some patches
> against cyrus-sasl-2.1.19 earlier in the year which I am using to allow
> 2 mechs. The patches are a bit messy because I did not want to change
> too much core stuff.
>
> It would not be too difficult to make the support a lot better.
>
> My command line looks like this:
> /usr/sbin/saslauthd -m /var/run/saslauthd -O /etc/saslauthd.conf -a ldap
> -V -O /etc/saslauthd-httpform.conf -a httpform
>
> The return value of the second mech is not currently used but that is
> easy to change. I use the httpform as a way of synchronising passwords
> to other systems. For a generic solution some syntax regarding what to
> do on success or failure would need to be developed.
>
> My patches also allow per realm configuration for the ldap mech and
> fixes some bugs in the httpform mech.
>
> If you want the patches, let me know.
>
> John.
>
>