Hi, having GSSAPI in ejabberd would be great: http://www.ejabberd.im/cyrsasl_gssapi Cheers, -- Guido
Personally, I think support for GSSAPI makes sense as this would help ejabberd spread in corporate (that is, "enterprisey") environments where SSO is often a requirement or at least a boost. Personally, I would use this on the Windows AD networks I administer. Unfortunately, as per [1], the status of this code is unknown to me; also unknown is its status with regard to 2.1.x ejabberd series. Another trouble is that after a quick glance over the link above, I failed to find any HOWTO about how to set things up. The list of XMPP clients supporting this feature is also not immediately obvious to me. So, do you have any clarifications on the points stated above? A "success story" about actual deployment would be best to hear, of course. 1. https://support.process-one.net/browse/EJAB-831
Hi Konstantin, I've not used the GSSAPI or SASL support of ejabberd myself yet. I'll give it a go and report back. This might take some time until I get around to it though. Thanks for your prompt response. -- Guido
Hi, I work for an organization which deploys ejabberd for their customers (as part of our server software). Two of our customers currently use ejabberd with GSSAPI (one company is about 500 and the other 150) and it seems to be stable so far. I would be more than happy to help with this. There isn't any much configuration involved (apart from that which is necessary for any service which supports GSSAPI) and a few configuration parameters. Also esasl is a necessary dependency for GSSAPI to work in ejabberd. I have already built a deb package for it. If you decide to include GSSAPI patch, I shall work in bringing the esasl package into better shape. I have a gssapi patch ready for ejabberd 2.1.5 which has been taken from badlop gssapi tree. Regards, Rahul.
Guido, are you wanting ejabberd to accept Kerberos tickets (that would require client code to be adapted)? Are there any examples of clients that support this? Or is it just to verify the password against a Kerberos server, instead of an LDAP server?
We've been using the Debian ejabberd for some time now at work and we're already authenticating against our Kerberos server with the help of libpam-krb5. So no need to change anything for that. The missing feature is the support for kerberos tickets. I will look into the GSSAPI-patch for ejabberd as soon as I find some spare time. I'll report back when it's working. A little bit of googling shows that there seem to be some clients that support Kerberos tickets (at least after some patching): http://www.sxw.org.uk/computing/patches/jabber.html http://kb.its.psu.edu/node/1567 Best regards, Raoul
Did any of those who participated in this dicsussion try the GSSAPI code and are able to report their results? Just to clarify: I'm not going to close this bug report, but I'd like to know if I should try to do something about it in time for Wheezy, and this requires someone who actually did something to see if the proposed code works.
Hi, if I understand it right, this has been solved by upstream: https://support.process-one.net/browse/EJAB-831 Does that mean this bug can be closed once a new version of ejabberd reaches Debian Sid? Regards,
Hopefully. I'd be happy to test it once it enters the archive. Cheers, -- Guido
Hopefully. I'd be happy to test it once it enters the archive. Cheers, -- Guido
Hi, ejabberd 14.07 is in the archive by now and you're welcome to test the GSSAPI support. Regards,
Hi Uploaded upstream version (14.07) does not support GSSAPI at all. And I can't find anything about GSSAPI in sources. Maybe processone drop GSSAPI support from 3.x in new releases? https://support.process-one.net/browse/EJAB-831 closed with "Fix Version/s: ejabberd 3.0.0-alpha-1"
https://support.process-one.net/browse/EJAB-831 has been reopened upstream, and there is a new patch attached against master (which unfortunately doesn't apply cleanly to the Debian source package).
Hi. I updated a patch in https://support.process-one.net/browse/EJAB-831 so it can be applied to debian 16.03 version and it work for me. Does anybody else can check out the new patch (831-fixed.patch)?
Hi everybody, the issue has been moved to github and testers are needed for it to become available with recent ejabberd releases: https://github.com/processone/ejabberd/issues/1586 Regards,