29

Numerous times i have met the expression SASL/GSSAPI. I have searched Google many times, but i simply do no understand what it is and how it relate to Kerberos.

Anybody that have a simple explanation on this?

2 Answers2

70

SASL stands for Simple Authentication and Security Layer; it's a framework that allows developers to implement different authentication mechanisms, and allows clients and servers to negotiate a mutually acceptable mechanism for each connection (rather than hard-coding or pre-configuring them).

GSSAPI stands for Generic Security Services Application Program Interface; it is usually made available as one of the mechanisms that SASL can use. It is itself another framework for developing and implementing various authentication mechanisms. These mechanisms include Kerberos, NTLM, and SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism): a GSSAPI pseudo-mechanism which allows GSSAPI-compatible clients to negotiate which GSSAPI mechanism they want to use.

Here's an example to help make this a little clearer (brutally simplified for clarity's sake):

  1. Client connects to server and says, "I support SASL! How should I authenticate myself?"
  2. Server receives the connection and responds, "I also support SASL, and can use these mechanisms, in descending order of preference: GSSAPI, CRAM-MD5, PLAIN."
  3. Client responds, "Of the choices, I'd like to use GSSAPI."
  4. Server responds "GSSAPI? Capital. I support Kerberos and NTLM."
  5. Client responds "Let's use Kerberos. Here's my encrypted ticket etc. etc."
Handyman5
  • 5,177
  • 25
  • 30
8

SASL and GSSAPI are frameworks that various authentication providers can be plugged into. People wishing to use Kerberos authentication in an app that supports SASL or GSSAPI need only to provide the appropriate Kerberos plugin, rather than rewrite the app with Kerberos-specific code.

dsolimano
  • 1,290
  • 2
  • 14
  • 26
  • 2
    Indeed, as I said, "SASL . . . that various authentication providers can be plugged into". They are two different frameworks that you can plug various authentication providers, such as Kerberos or NTLM, into. – dsolimano May 10 '10 at 02:13
  • SASL is more of a implementation specification usually for text based protocols (like SMTP, IMAP, etc). GSSAPI is an application interface definition for plugins that support various authentications mechanisms. SASL can use GSSAPI to extend it's auth mechanisms. – Chris S Jun 04 '11 at 00:52
  • 1
    without giving a concrete '''example''' which actual provider plugs into which real-world framework, most people don't know what you are talking about. – dotbit Dec 30 '19 at 16:03