LDAP issue with SASL 2.1.26

[Howard Chu]

Bill MacAllister wrote:
>
>
> --On Monday, December 02, 2013 01:14:24 PM -0800 Sergey Emantayev <sergeem at yahoo.com> wrote:
>
>> Hello,
>>
>> We successfully use OpenLDAP C SDK 2.4.36 integrated with Cyrus-SASL
>> 2.1.23. Recently we have upgraded Cyrus-SASL to 2.1.26 and
>> encountering the next issue.
>>
>> LDAP search consistently fails. We analyzed this issue and found the
>> following behavior.
>>
>> When we use OpenLDAP with Cyrus-SASL 2.1.23 the LDAP Message Search
>> Request payload is wrapped in GSS-API payload.
>>
>> When we use OpenLDAP with Cyrus-SASL 2.1.26 the LDAP Message Search
>> Request payload is not wrapped in GSS-API payload at all. LDAP
>> Search Request looks like clear text LDAP Search Request and not
>> like LDAP SASL Search Request.
>>
>> In both cases - with Cyrus-SASL 2.1.23 and with Cyrus-SASL 2.1.26 –
>> LDAP SASL Bind succeeds and LDAP SASL bindResponse looks identical
>> with Cyrus-SASL 2.1.23 and with Cyrus-SASL 2.1.26.
>>
>> Please advise how to troubleshoot the issue.
>
> When I tried using 2.1.26 I had to set minssf to get it to work.  Here
> is the setting that we are currently using.
>
>    olcSaslSecProps: minssf=1,noplain,noanonymous

This sounds like a regression in Cyrus SASL; certainly it is an undocumented 
change in behavior. Can you confirm that the behavior from 2.1.23-2.1.25 
wasn't changed?

-- 
   -- Howard Chu
   CTO, Symas Corp.           http://www.symas.com
   Director, Highland Sun     http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP  http://www.openldap.org/project/