libvirt users - Dec 2011 - acceptable SASL mechanisms/can libvirt authenticate against PAM

I was playing with SASL authentication a bit today and I wasn't able
to get libvirt to authenticate against PAM (or anything else except
the sasldb, although I didn't try Kerberos).  Does anybody know off
the top of their head what mechanisms/password check options work?
I'm trying to figure out if I'm attempting the impossible.

Dave

On Wednesday 2011-12-14, Dave Allan wrote:
> I was playing with SASL authentication a bit today and I wasn't able
> to get libvirt to authenticate against PAM (or anything else except
> the sasldb, although I didn't try Kerberos).  Does anybody know off
> the top of their head what mechanisms/password check options work?
> I'm trying to figure out if I'm attempting the impossible.
> 
> Dave

Hi Dave,

Here is my working configuration with sql backend. I am using postgres.

mech_list: digest-md5
pwcheck_method: auxprop
auxprop_plugin: sql
sql_engine: pgsql  
sql_hostnames: localhost            
sql_user: qemukvm
sql_passwd: secret   
sql_database: qemukvmdb
sql_select: select password from qemuusers where username = '%u'


To make use of PAM as far as I know you will have to use saslauthd method.

And here is the list of relevant sasl options (I am not sure if it's up to 
date): http://asyd.net/docs/cyrus-options.html


-- 
Josip Deanovic

On Tue, Dec 13, 2011 at 10:57:25PM -0500, Dave Allan
wrote:
> I was playing with SASL authentication a bit today and I wasn't able
> to get libvirt to authenticate against PAM (or anything else except
> the sasldb, although I didn't try Kerberos).  Does anybody know off
> the top of their head what mechanisms/password check options work?
> I'm trying to figure out if I'm attempting the impossible.
If you are configuring SASL for the tcp socket it will refuse to use
SASL mechanisms which do not support encryption, which is all of them
except Kerberos or Digest-MD5.

If you are configuring SASL for the TLS socket it will allow any
SASL mechanism, since TLS provides the encryption

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|

On Wednesday 2011-12-14, Josip Deanovic wrote:
> On Wednesday 2011-12-14, Dave Allan wrote:
> > I was playing with SASL authentication a bit today and I wasn't
able
> > to get libvirt to authenticate against PAM (or anything else except
> > the sasldb, although I didn't try Kerberos).  Does anybody know
off
> > the top of their head what mechanisms/password check options work?
> > I'm trying to figure out if I'm attempting the impossible.
> > 
> > Dave
> 
> Hi Dave,
> 
> Here is my working configuration with sql backend. I am using postgres.
> 
> mech_list: digest-md5
> pwcheck_method: auxprop
> auxprop_plugin: sql
> sql_engine: pgsql
> sql_hostnames: localhost
> sql_user: qemukvm
> sql_passwd: secret
> sql_database: qemukvmdb
> sql_select: select password from qemuusers where username = '%u'
> 
> 
> To make use of PAM as far as I know you will have to use saslauthd
> method.
> 
> And here is the list of relevant sasl options (I am not sure if it's up
> to date): http://asyd.net/docs/cyrus-options.html

Sorry, I was mistakenly referring to sasl authentication for vnc client with 
sasl support.
However, this configuration might work with libvit with little or no 
modifications. However I never tried to authenticate to libvrit using sasl.


-- 
Josip Deanovic