krb5 required when building with sasl support

krb5 required when building with sasl support

[Matthias Koenig]

Hi,

it seems that it is necessary to link also against krb5 when
building the LDAP lookup module with SASL support.
This is missing currently in the configure.in it only
links with -lsasl.
The following patch should fix this.

Regards,
Matthias

Index: autofs-5.0.4/configure.in
===================================================================
--- autofs-5.0.4.orig/configure.in	2008-11-04 02:36:48.000000000 +0100
+++ autofs-5.0.4/configure.in	2009-02-04 17:30:01.000000000 +0100
@@ -256,8 +256,13 @@ AC_ARG_WITH(sasl,
 if test -z "$HAVE_SASL" -o "$HAVE_SASL" != "0" -a "$HAVE_LIBXML" == "1"
 then
 	HAVE_SASL=0
-	AC_CHECK_LIB(sasl2, sasl_client_start, HAVE_SASL=1 LIBSASL="$LIBSASL -lsasl2", , -lsasl2 $LIBS)
+        HAVE_KRB5=0
+	AC_CHECK_LIB(sasl2, sasl_client_start, HAVE_SASL=1,, -lsasl2 $LIBS)
+        AC_CHECK_LIB(krb5, krb5_mk_req_extended, HAVE_KRB5=1,, $LIBS)
 	if test "$HAVE_SASL" == "1"; then
+		test "$HAVE_KRB5" != "1" && \
+                    AC_MSG_FAILURE([You need krb5 libs to build with SASL support])
+                LIBSASL="$LIBSASL -lsasl2 -lkrb5"
 		AC_DEFINE(WITH_SASL,1,
 			[Define if using SASL authentication with the LDAP module])
 	fi

Re: krb5 required when building with sasl support

[Ondrej Valousek]

+1 - I have spotted this, too....
O.
Matthias Koenig wrote:
> Hi,
>
> it seems that it is necessary to link also against krb5 when
> building the LDAP lookup module with SASL support.
> This is missing currently in the configure.in it only
> links with -lsasl.
> The following patch should fix this.
>
> Regards,
> Matthias
>
> Index: autofs-5.0.4/configure.in
> ===================================================================
> --- autofs-5.0.4.orig/configure.in	2008-11-04 02:36:48.000000000 +0100
> +++ autofs-5.0.4/configure.in	2009-02-04 17:30:01.000000000 +0100
> @@ -256,8 +256,13 @@ AC_ARG_WITH(sasl,
>  if test -z "$HAVE_SASL" -o "$HAVE_SASL" != "0" -a "$HAVE_LIBXML" == "1"
>  then
>  	HAVE_SASL=0
> -	AC_CHECK_LIB(sasl2, sasl_client_start, HAVE_SASL=1 LIBSASL="$LIBSASL -lsasl2", , -lsasl2 $LIBS)
> +        HAVE_KRB5=0
> +	AC_CHECK_LIB(sasl2, sasl_client_start, HAVE_SASL=1,, -lsasl2 $LIBS)
> +        AC_CHECK_LIB(krb5, krb5_mk_req_extended, HAVE_KRB5=1,, $LIBS)
>  	if test "$HAVE_SASL" == "1"; then
> +		test "$HAVE_KRB5" != "1" && \
> +                    AC_MSG_FAILURE([You need krb5 libs to build with SASL support])
> +                LIBSASL="$LIBSASL -lsasl2 -lkrb5"
>  		AC_DEFINE(WITH_SASL,1,
>  			[Define if using SASL authentication with the LDAP module])
>  	fi
>
> _______________________________________________
> autofs mailing list
> autofs@linux.kernel.org
> http://linux.kernel.org/mailman/listinfo/autofs
>   

Re: krb5 required when building with sasl support

[Guillaume Rousse]

Ondrej Valousek a écrit :
> +1 - I have spotted this, too....
<aol>
/me too
</aol>

More seriously, I think the proper solution would rather be fixing 
underliking in SASL (http://wiki.mandriva.com/en/Underlinking).

Anyway, it doesn't hurt to workaround the problem in autofs.


-- 
BOFH excuse #151:

Some one needed the powerstrip, so they pulled the switch plug.

Re: krb5 required when building with sasl support

[Matthias Koenig]

Guillaume Rousse <Guillaume.Rousse@inria.fr> writes:

> More seriously, I think the proper solution would rather be fixing 
> underliking in SASL (http://wiki.mandriva.com/en/Underlinking).

Hmm, are you really sure, that libsasl depends on kerberos symbols?
In this case you would be right.
I assumed that they're independent from each other and after
a quick grep I couldn't find any krb5_* symbols in libsasl.
At least the lookup_ldap.h header from autofs explicitly includes
the krb5.h header.

Matthias

Re: krb5 required when building with sasl support

[Ondrej Valousek]

sasl could be (theoretically) built without GSSAPI support and in this
case it would not require Kerberos. But the facts are:
- sasl support in autofs can not be obviously compiled without gssapi
- in these days sasl is many times meant as synonym for sasl/gssapi so
it probably does not make any sense not to include gssapi once we
include sasl.

Ondrej

Matthias Koenig wrote:
> Guillaume Rousse <Guillaume.Rousse@inria.fr> writes:
>
>   
>> More seriously, I think the proper solution would rather be fixing 
>> underliking in SASL (http://wiki.mandriva.com/en/Underlinking).
>>     
>
> Hmm, are you really sure, that libsasl depends on kerberos symbols?
> In this case you would be right.
> I assumed that they're independent from each other and after
> a quick grep I couldn't find any krb5_* symbols in libsasl.
> At least the lookup_ldap.h header from autofs explicitly includes
> the krb5.h header.
>
> Matthias
>
> _______________________________________________
> autofs mailing list
> autofs@linux.kernel.org
> http://linux.kernel.org/mailman/listinfo/autofs
>   

Re: krb5 required when building with sasl support

[Guillaume Rousse]

Ondrej Valousek a écrit :
> sasl could be (theoretically) built without GSSAPI support and in this
> case it would not require Kerberos. But the facts are:
> - sasl support in autofs can not be obviously compiled without gssapi
> - in these days sasl is many times meant as synonym for sasl/gssapi so
> it probably does not make any sense not to include gssapi once we
> include sasl.

But you should be able to link against SASL without prior knowledge of 
its own dependencies. That's the point of avoiding distributing 
underlinked libraries.

Re: krb5 required when building with sasl support

[Guillaume Rousse]

Matthias Koenig a écrit :
> Guillaume Rousse <Guillaume.Rousse@inria.fr> writes:
> 
>> More seriously, I think the proper solution would rather be fixing 
>> underliking in SASL (http://wiki.mandriva.com/en/Underlinking).
> 
> Hmm, are you really sure, that libsasl depends on kerberos symbols?
> In this case you would be right.
> I assumed that they're independent from each other and after
> a quick grep I couldn't find any krb5_* symbols in libsasl.
> At least the lookup_ldap.h header from autofs explicitly includes
> the krb5.h header.
Indeed. I just checked libsasl is built with -Wl,--no-undefined flag, 
and doesn't have undefined symbols either.

I guess the issue (in my case) is not to detect SASL presence, but to 
add -lkrb5 when building autofs ldap plugin (which can't use 
-Wl,--no-undefined safety option, as it is a plugin).