[Bug 1984073] Re: autofs: regression on focal->jammy upgrade: SASL binds to Samba AD broken

[rdratlos]

Upstream has reviewed the patches and put them into the update queue. As for #1982219 release will be delayed and most probably will make the way into a new version 5.1.9.
I've prepared a PPA with the latest version from upstream:
PPA: https://launchpad.net/~rdratlos/+archive/ubuntu/lp-1984073-autofs-broken-sasl-binds-to-samba-ad

Please feel free to test and provide feedback.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to autofs in Ubuntu.
https://bugs.launchpad.net/bugs/1984073

Title:
   autofs: regression on focal->jammy upgrade: SASL binds to Samba AD
  broken

Status in autofs package in Ubuntu:
  Triaged

Bug description:
  automounter version 5.1.8 does not support SASL security layer
  encryption and only relies on TLS to protect (encrypt) LDAP traffic.

  Since version 4.4 Samba AD domain controllers' default settings only allow
  for simple SASL binds over TLS encrypted connections or SASL binds with
  sign or seal, i. e. data security layer encryption, over unencrypted
  connections. Therefore, current automounter cannot fetch autofs maps from
  Samba AD DCs using SASL anymore without setting Samba configuration
  parameter "ldap server require strong auth" to "no" or "allow_sasl_over_tls".

  Cyrus SASL supports data encryption in GSSAPI (with Kerberos V) mode using
  an SASL data security layer according to IETF RFC 2078. This security layer
  provides for traffic encryption during authentication and authorization
  towards an OpenLDAP based server and for subsequent encryption of data
  traffic for the LDAP session. OpenLDAP libldap and OpenLDAP clients support
  automatic installation of (Cyrus) SASL data security layer.

  automounter version 5.1.8 uses its own interface to Cyrus SASL API and does
  not rely on OpenLDAP libldap for SASL binds. This leads to security degradation
  when using Samba AD or OpenLDAP directory services to store automount maps.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/autofs/+bug/1984073/+subscriptions