macOS OpenLDAP client libraries clarification

[nixtar]

Hello,

I'm in the planning phase of a dotnet macOS app that requires LDAP integration.

This library looks really good, but I'd like to know how to best handle the OpenLDAP client libraries dependency.
Is it something I can distribute with the app or does it need to be installed as a separate package on client devices?

It also appears that Apple includes their own fork of OpenLDAP https://github.com/apple-oss-distributions/OpenLDAP/tree/OpenLDAP-556 is this compatible with ldap4net?

Thanks,
Nick

[chrpai]

I'm in the same boat as you. Wanting to make a MAUI Blazor app that can connect to LDAP and do some object searching and group membership updating. So far I've figured out how to use Brew to install the openldap dependency. I haven't actually been able to bind to AD with Kerberos yet. It just tells me that the server isn't found in the kerberos database. I don't know enough about MacOS to understand what configuration/dependencies I have here. I'm guessing I have to do something to checkout a kerb ticket. I know something is possible because I can map SMB shares and hit an IIS website that uses Windows Auth.

[nixtar]

After some testing it turns out ldat4net can use the OpenLDAP libraries that are included with macOS without any issues that I've run into yet.

You can see here its loading libldap on macos instead of ldap.so.2 like on linux.

Our Macs are not bound to the domain so I've not tested using Kerberos to bind however.

I'm using a Xamarin.Mac project using net8.0-macos target framework.

[chrpai]

I'm waiting for clarification from my fellow macusers at work but my best understanding is we are local accounts and have migrated from enterprise connect to the kerberos sso plugin. I don't know if that facilitates what I'm trying to do here.

[chrpai]

I used brew to install openldap and then removed it after reading what you wrote. When I try to run the c# sample projetc found in this repos I get the error:

Unable to find an entry point named 'ldap_sasl_interactive_bind' in shared library 'libldap'.

This feels like DLL hell on Windows. :) Any ideas on how to resolve it? A google search for "Unable to find an entry point named" ldap_sasl_interactive_bind gives me zero hits.

I'm running Sonoma 14.3.1 on apple silicon if it matters.

[nixtar]

This has set off some alarm bells for us ( me ).
Currently I'm developing on an Intel mac running 13.6.

As far as I can see ldap_sasl_interactive_bind is still in Apples fork of OpenLDAP https://github.com/apple-oss-distributions/OpenLDAP/blob/4179b8d6a685fe7d2cc28ad7453e3b0e1547e3e8/OpenLDAP/libraries/libldap/sasl.c#L413

Have you tried testing with ldapsearch on the mac without the libraries installed by brew?
EG:
Check you have kerberos token using klist command
If not create it with kinit username@DOMAIN
Search for the users own account using GSAPI: ldapsearch -H ldap://domain-Y GSSAPI -b "dc=domain" "(SAMAccountName=username)"

I've tested the app on an Apple Silicon device that is also running 13.6 (compiled with osx-x64;osx-arm64 so it's a universal app) and it still appears to work.
I'll try and get another mac that I can upgrade to 14.3.1 and test there also.

However, our exact use case doesn't use kerberos ( ldap_sasl_interactive_bind ), we prompt the user for their domain credentials and bind that way. Using brew to build the OpenLDAP libraries is also not an option for us, if it turns out that there are issues using Apples built in OpenLDAP libs then we might have to switch to another dotnet ldap library such as the old novel ones. 😢

I'll keep this thread updated with my findings.

[nixtar]

Oh hang on...

I can see that ldapsearch is using ldap_sasl_interactive_bind_s and not ldap_sasl_interactive_bind.

Looking here I can see that ldap4net uses ldap_sasl_interactive_bind_s when you use the non async bind method.
If you are not already, can you try use the non async bind command?

If I switch to BindAsync I can also reproduce this issue regardless of kerberos!
Unable to find an entry point named 'ldap_sasl_interactive_bind' in shared library 'libldap'.

[nixtar]

I can't find any obvious doco on the difference between ldap_sasl_interactive_bind_s and ldap_sasl_interactive_bind.

Perhaps @flamencist can comment on this?

[nixtar]

Looking a little bit deeper ldap_sasl_interactive_bind and ldap_sasl_interactive_bind_s are both technically in Apples code.

But only ldap_sasl_interactive_bind_s is made public using exported_symbols_list pointing to https://github.com/apple-oss-distributions/OpenLDAP/blob/main/AppleExtras/ldap.exp in the makefile.

[chrpai]

I'm not getting that error anymore but now it says is failing trying to get a ticket that is in the format of krbtgt/X.Y.Z@domain.com where X.Y.Z is the last 3 octets of the AD IP address instead of myuser@domain.com.

[chrpai]

I'm getting the same error just running ldapsearch.