+Overview
+========
+
This is an implementation of the GSS EAP mechanism, as described in
-draft-howlett-eap-gss-xx.txt.
+draft-ietf-abfab-gss-eap-00.txt.
+
+Building
+========
In order to build this, a recent Kerberos implementation (MIT or
Heimdal), Shibboleth, and EAP libraries are required, along with
all of their dependencies.
+
+Note: not all SPIs are supported by the Heimdal mechanism glue,
+so not all features will be available.
+
+Installing
+==========
+
+When installing, be sure to edit $prefix/etc/gss/mech to register
+the EAP mechanisms. A sample configuration file is in this directory.
+
+Make sure your RADIUS library is configured to talk to the server of
+your choice: see the example radsec.conf in this directory.
+
+On the RADIUS server side, you need to install dictionary.ukerna and
+include it from the main dictionary file.
+
+If you want the acceptor be able to identify the user, the RADIUS
+server needs to echo back the EAP username from the inner tunnel;
+for privacy, mech_eap only sends the realm in the EAP Identity
+response. To configure this with FreeRADIUS, add:
+
+ update outer.reply {
+ User-Name = "%{request:User-Name}"
+ }
+
+to /etc/raddb/sites-enabled/inner-tunnel, and make sure that
+
+ virtual_server = "inner-tunnel"
+
+is set in eap.conf for the EAP types being used.
+
+To test the SAML assertion code path, you can place a fixed SAML
+assertion in the update reply block of the default configuration.
+
+ update reply {
+ SAML-AAA-Assertion = '<saml:Assertion ...'
+ SAML-AAA-Assertion += '...'
+ }
+
+Testing
+=======
+
+You can then test the MIT or Cyrus GSS and SASL example programs.
+Sample usage is given below. Substitute <user>, <pass> and <host>
+appropriately (<host> is the name of the host running the server,
+not the RADIUS server).
+
+% gss-client -port 5555 -spnego -mech "{1 3 6 1 4 1 5322 22 1 18}" \
+ -user <user> -pass <pass> <host> host@<host> "Testing GSS EAP"
+% gss-server -port 5555 -export host@<host>
+
+Note: for SASL you will be prompted for a username and password.
+
+% client -C -p 5556 -s host -m EAP-AES128 <host>
+% server -c -p 5556 -s host -h <host>
+
projects / mech_eap.orig / blobdiff