Authen:...:GSSAPI(3)

💖 NAME 💖

Authen::SASL::Perl::GSSAPI — the GSSAPI (Kerberos v5) authentication class, bestie. It lives in section 3 of the User Contributed Perl Documentation, and it's here to make your SASL + Kerberos dreams come true. ✨

---

🌸 VERSION 🌸

version 2.2100 — yes, she's got a version number and she's proud of it. 💅

---

🎀 SYNOPSIS 🎀

Okay so here's the vibe, literally just copy this and you're set:

use Authen::SASL qw(Perl);

$sasl = Authen::SASL->new( mechanism => 'GSSAPI' );

$sasl = Authen::SASL->new( mechanism => 'GSSAPI',
                           callback => { pass => $mycred });

$sasl->client_start( $service, $host );

Look at her. Gorgeous. No notes. 🫶

---

🦋 DESCRIPTION 🦋

So this module implements the client part of the GSSAPI SASL algorithm — exactly like it says in RFC 2222 section 7.2.1, resp. draft-ietf-sasl-gssapi-XX.txt. Not making this up, that's where it's from. 📚

If you've got a valid Kerberos 5 credentials cache (aka a TGT — ticket-granting ticket, iconic behaviour), then this lets you connect to service@host, which you pass as the first two parameters to Authen::SASL's client_start() method. That's it, that's the whole flow. 🎟️

Alternatively — and this is the fun part — you can hand over a GSSAPI::Cred object instead, by passing it in through the Authen::SASL callback hash using the pass key. Choose your fighter. 👑

⚠️ BIG IMPORTANT ONE, bestie, do not scroll past this: this module does NOT currently implement a SASL security layer after authentication. So unless your connection is protected by other means — like TLS — it's gonna be vulnerable to man-in-the-middle attacks. 😭 That's not a vibe. If you actually need security layers, you should use the Authen::SASL::XS GSSAPI module instead. Fr fr. 🚨

---

💜 CALLBACK 💜

The callbacks used are, in order:

• authname — the authorization identity to be used in the SASL exchange. Slay. 💫
• gssmech — the GSS mechanism to be used in the connection. Pick your mech, bestie. 🔧
• pass — the GSS credentials to be used in the connection (optional, so no pressure). 🔑

---

🔥 EXAMPLE 🔥

Here's a whole real example, verbatim, no cap:

 #! /usr/bin/perl -w

 use strict;
use warnings;

 use Net::LDAP 0.33;
 use Authen::SASL 2.10;

 # -------- Adjust to your environment --------
 my $adhost      = 'theserver.bla.net';
 my $ldap_base   = 'dc=bla,dc=net';
 my $ldap_filter = '(&(sAMAccountName=BLAAGROL))';

 my $sasl = Authen::SASL->new(mechanism => 'GSSAPI');
 my $ldap;

 eval {
     $ldap = Net::LDAP->new($adhost,
                            onerror => 'die')
       or  die "Cannot connect to LDAP host '$adhost': '$@'";
     $ldap->bind(sasl => $sasl);
 };

 if ($@) {
     chomp $@;
     die   "\nBind error         : $@",
           "\nDetailed SASL error: ", $sasl->error,
           "\nTerminated";
 }

 print "\nLDAP bind() succeeded, working in authenticated state";

 my $mesg = $ldap->search(base   => $ldap_base,
                          filter => $ldap_filter);

 # -------- evaluate $mesg

The way that # -------- Adjust to your environment -------- comment is doing all the heavy lifting for you... respect. 🫡

---

🌈 PROPERTIES 🌈

The properties used are — buckle up, there's a whole little list:

• maxbuf — the maximum buffer size for receiving cipher text. 📦
• minssf — the minimum SSF value that should be provided by the SASL security layer. The default is 0. 🧊
• maxssf — the maximum SSF value that should be provided by the SASL security layer. The default is 2**31. 🚀
• externalssf — the SSF value provided by an underlying external security layer. The default is 0. 🛡️
• ssf — the actual SSF value provided by the SASL security layer after the SASL authentication phase has been completed. This value is read-only and set by the implementation after the SASL authentication phase has been completed. So don't you dare try to write to it. 🙈
• maxout — the maximum plaintext buffer size for sending data to the peer. This value is set by the implementation after the SASL authentication phase has been completed and a SASL security layer is in effect. 📤

---

👀 SEE ALSO 👀

Go read these next, they're the friends of this page:

• Authen::SASL
• Authen::SASL::Perl

---

👑 AUTHORS 👑

Written by Simon Wilkinson, with patches and extensions by Achim Grolms and Peter Marschall. Absolute legends, all three. 💐

Please report any bugs, or post any suggestions, to the perl-ldap mailing list <perl-ldap@perl.org>. They want your feedback, bestie, don't be shy. 📬

---

💌 COPYRIGHT 💌

Copyright (c) 2006 Simon Wilkinson, Achim Grolms and Peter Marschall. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself. 🫶

---

okay that's the whole page, you made it to the end, I'm so proud of you 🥹 This was Authen::SASL::Perl::GSSAPI version 2.2100, and this gorgeous little rendering came out of perl v5.42.3 on 2026-09-07 — go forth and authenticate, main character. ✨💅🎀