LDAP bind using ldap_sasl_interactive_bind_s and DIGEST-MD5 fails the second time

[James Bong]

I am currently using Mac OS X 10.6.2 and am attempting to use the
ldap_sasl_interactive_bind_s
API to do a digest-md5 authentication against Active Directory (2008, though
I don't think it matters what flavor of AD is used). The bind works fine the
first time. However, if I unbind and attempt to rebind as the same user, it
fails with ldap_sasl_interactive_bind_s: Invalid credentials (49). If I bind
with a different user, then unbind, and bind as the original user, it works.
I created a simple program that illustrates the issue. When run, it binds
correctly, unbinds, and then fails on the second bind:

trying
ldap_sasl_interactive_bind_s
callback
callback done
ldap_sasl_interactive_bind_s Done
Unbinding
Unbound.
ldap_sasl_interactive_bind_s
callback
callback done
ldap_sasl_interactive_bind_s: Invalid credentials (49)
additional info: 80090308: LdapErr: DSID-0C0904D1, comment:
AcceptSecurityContext error, data 57, v1772


Any idea why it is not possible to use the same credentials twice?

Here is the test program. I tried reinitializing the sasl library with
sasl_done and sasl_client_init, but that doesn't seem to make a difference.

#include <ldap.h>
#include <sasl/sasl.h>
#include <stdio.h>

typedef struct sasl_defaults {
    char *mech;
    char *realm;
    char *authcid;
    char *passwd;
    char *authzid;
} sasl_defaults;

int callback(LDAP *ld, unsigned flags, void* defaults, void *interact ) {
    printf("callback\n");
    sasl_interact_t *in_out=(sasl_interact_t *)interact;
    sasl_defaults *in_defaults=(sasl_defaults *)defaults;

    while (in_out->id !=SASL_CB_LIST_END) {

        switch (in_out->id) {
            case SASL_CB_USER:
in_out->result=in_defaults->authcid;
 in_out->len=strlen(in_defaults->authcid);
                break;
            case SASL_CB_AUTHNAME:
in_out->result=in_defaults->authcid;
                in_out->len=strlen(in_defaults->authcid);
                break;
            case SASL_CB_PASS:
in_out->result=in_defaults->passwd;
                in_out->len=strlen(in_defaults->passwd);
                break;
            case SASL_CB_GETREALM:
in_out->result="";
                in_out->len=strlen("");
                break;

        }

        in_out++;
    }
    printf("callback done\n");
    return 0;
}



int main (int argv, char ** argc) {

    printf("trying\n");
    for (;;) {
        LDAP *ld;

        ldap_initialize(&ld, "ldap://dc.ad.domain.com:389";);

        ldap_set_option(ld,LDAP_OPT_REFERRALS,LDAP_OPT_OFF);

         int version=3;
        ldap_set_option( ld, LDAP_OPT_PROTOCOL_VERSION, &version );
        int timelimit=5;
        if (ldap_set_option( ld, LDAP_OPT_TIMELIMIT, (void *) &timelimit )
!= LDAP_OPT_SUCCESS )
        {
            printf("err\n");
            return -1;
        }

        sasl_defaults defaults;
        defaults.mech = "DIGEST-MD5";
        defaults.passwd="password";
        defaults.authcid="user";
        defaults.realm="realm.com";
        defaults.authzid="user";

        printf("ldap_sasl_interactive_bind_s\n");
        int rc=ldap_sasl_interactive_bind_s( ld, NULL,defaults.mech, NULL,
NULL, LDAP_SASL_QUIET, callback, &defaults );

        if( rc != LDAP_SUCCESS ) {

            ldap_perror( ld, "ldap_sasl_interactive_bind_s" );
                ldap_unbind(ld);
            return -1;
        }
        printf("ldap_sasl_interactive_bind_s Done\n");

        printf("Unbinding\n");
        ldap_unbind(ld);
        printf("Unbound.\n");
        sleep(5);

    }
}