checksum mismatch with GSSAPI

[bersace]

Hi,

I'm using go-ldap/v3 in ldap2pg. I'm happy to test the new GSSAPI feature of go-ldap. I got a setup for Samba 4 as KDC and Service authicated using Kerberos. kinit + ldapsearch -Y GSSAPI works fine. I'm now implementing the client side in Go. However, I'm hiting an odd error : checksum mismatch. I didn't found this error in ldap/gssapi. I guess it's deeper in gokrb5. But how to determine the cause of this mismatch ?

The implementation so far is at dalibo/ldap2pg#645

Thanks for your help !

Regards,
Étienne

[Conty111]

Hi,

I'm using go-ldap/v3 in ldap2pg. I'm happy to test the new GSSAPI feature of go-ldap. I got a setup for Samba 4 as KDC and Service authicated using Kerberos. kinit + ldapsearch -Y GSSAPI works fine. I'm now implementing the client side in Go. However, I'm hiting an odd error : checksum mismatch. I didn't found this error in ldap/gssapi. I guess it's deeper in gokrb5. But how to determine the cause of this mismatch ?

The implementation so far is at dalibo/ldap2pg#645

Thanks for your help !

Regards, Étienne

Hi! Have you already solved your problem now? I have the same issue - I am getting "checksum mismatch" error when I am trying to use GSS API bind (GSSAPIBind method)

[cpuschma]

@Conty111 What release are you using? Maybe you're affected by a bug fixed in b7e97bb. This was fixed and released in v3.4.11

[bersace]

dalibo/ldap2pg#645 uses v3.4.12. We'll check this out again.

[bersace]

I'm wondering if it's an issue rather in go-krb.

[Conty111]

I am using v3.4.12 of go-ldap

And I'm not 100% sure that it's problem in the library, but idk how to debug it.
I followed these steps with FreeIPA domain controller:

1. Create service principal
2. Add necessary roles/permissions to service
3. Create keytab file for service:

ipa-getkeytab -s dc-1.ald.company.lan -p HTTP/mac-authserver.ald.company.lan -k /tmp/mac-authserver.keytab

4. Read this keytab in code and create client

        kt, err := keytab.Load(cfg.Keytab)
	if err != nil {
		return fmt.Errorf("failed to load keytab: %w", err)
	}
         ...
         gssapiClient, err := gssapi.NewClientWithKeytab(
		c.kerberosPrincipal,
		c.kerberosRealm,
		cfg.Keytab,
		cfg.ConfigPath,
		client.DisablePAFXFAST(true),
	)
	...

	if err := gssapiClient.Login(); err != nil {
		....
	}

	c.gssApiClient = gssapiClient

5. Use the created client in GSSAPIBind

conn, err := ldap.DialURL(
		address,
		ldap.DialWithTLSConfig(&tls.Config{
			InsecureSkipVerify: true,
		}))
	if err != nil {
		...
	}

	conn.Debug = true
	
	targetSPN := fmt.Sprintf("ldap/%s", cl.host)
	
	err = conn.GSSAPIBind(cl.gssApiClient, targetSPN, "") // FAIL HERE
	...

Full code

I've tried to direct encryption methods in creation keytab and krb5.conf for my client, but it didn't work

Here's log of checksum mismatch error in my app:

2026/02/25 22:01:35 [2026-02-25T19:01:35Z] DEBUG: Attempting GSSAPI bind | {"client_principal":"HTTP/mac-authserver.ald.company.lan","host":"dc-1.ald.company.lan","target_spn":"ldap/dc-1.ald.company.lan"}
2026/02/25 22:01:35 flags&startTLS = 0
2026/02/25 22:01:35 1: waiting for response
2026/02/25 22:01:35 Sending message 1
2026/02/25 22:01:36 Receiving message 1
2026/02/25 22:01:36 1: got response 0x254fefc52230
LDAP Response: (Universal, Constructed, Sequence and Sequence of) Len=172 "<nil>"
 Message ID: (Universal, Primitive, Integer) Len=1 "1"
 Bind Response: (Application, Constructed, 0x01) Len=166 "<nil>"
  Result Code (Sasl Bind In Progress): (Universal, Primitive, Enumerated) Len=1 "14"
  Matched DN (): (Universal, Primitive, Octet String) Len=0 ""
  Error Message: (Universal, Primitive, Octet String) Len=0 ""
  Referral: (Context, Primitive, 0x07) Len=156 "<nil>"
2026/02/25 22:01:36 1: got response 0x254fefc52230
LDAP Response: (Universal, Constructed, Sequence and Sequence of) Len=172 "<nil>"
 Message ID: (Universal, Primitive, Integer) Len=1 "1"
 Bind Response: (Application, Constructed, 0x01) Len=166 "<nil>"
  Result Code (Sasl Bind In Progress): (Universal, Primitive, Enumerated) Len=1 "14"
  Matched DN (): (Universal, Primitive, Octet String) Len=0 ""
  Error Message: (Universal, Primitive, Octet String) Len=0 ""
  Referral: (Context, Primitive, 0x07) Len=156 "<nil>"
2026/02/25 22:01:36 Finished message 1
2026/02/25 22:01:36 flags&startTLS = 0
2026/02/25 22:01:36 2: waiting for response
2026/02/25 22:01:36 Sending message 2
2026/02/25 22:01:36 Receiving message 2
2026/02/25 22:01:36 2: got response 0x254fefc52850
LDAP Response: (Universal, Constructed, Sequence and Sequence of) Len=46 "<nil>"
 Message ID: (Universal, Primitive, Integer) Len=1 "2"
 Bind Response: (Application, Constructed, 0x01) Len=41 "<nil>"
  Result Code (Sasl Bind In Progress): (Universal, Primitive, Enumerated) Len=1 "14"
  Matched DN (): (Universal, Primitive, Octet String) Len=0 ""
  Error Message: (Universal, Primitive, Octet String) Len=0 ""
  Referral: (Context, Primitive, 0x07) Len=32 "<nil>"
2026/02/25 22:01:36 2: got response 0x254fefc52850
LDAP Response: (Universal, Constructed, Sequence and Sequence of) Len=46 "<nil>"
 Message ID: (Universal, Primitive, Integer) Len=1 "2"
 Bind Response: (Application, Constructed, 0x01) Len=41 "<nil>"
  Result Code (Sasl Bind In Progress): (Universal, Primitive, Enumerated) Len=1 "14"
  Matched DN (): (Universal, Primitive, Octet String) Len=0 ""
  Error Message: (Universal, Primitive, Octet String) Len=0 ""
  Referral: (Context, Primitive, 0x07) Len=32 "<nil>"
2026/02/25 22:01:36 Finished message 2
2026/02/25 22:01:36 [2026-02-25T19:01:36Z] ERROR: GSSAPI bind failed | {"error":"checksum mismatch. Computed: 840b76487a735ea52dc75e16, Contained in token: 072000001b4b6098355a7717","host":"dc-1.ald.company.lan","principal":"HTTP/mac-authserver.ald.company.lan"}
2026/02/25 22:01:36 Sending quit message and waiting for confirmation
2026/02/25 22:01:36 Shutting down - quit message received
2026/02/25 22:01:36 Closing network connection
2026/02/25 22:01:36 [2026-02-25T19:01:36Z] ERROR: Failed to initialize LDAP client | {"error":"failed to connect to LDAP: GSSAPI bind failed: checksum mismatch. Computed: 840b76487a735ea52dc75e16, Contained in token: 072000001b4b6098355a7717"}
exit status 1

[Conty111]

@cpuschma I'm sorry, but maybe you have an example of using connection.GSSAPIBind(client, spn, authzid)?
(https://github.com/go-ldap/ldap/blob/master/v3/bind.go#L685)

I'd try to repeat it and collect some debug info

[Conty111]

Funny survey: I've downgraded go-ldap version to v3.4.10 and it worked for me :)

So, probably, some problem is in 3.4.11 or 3.4.12 releases

[gliatti]

Yes we found something a problem with 3.4.11. I wait for him to have some time to confirm what I implemented and he will come back asap with what causes the issue and everything.

[bersace]

@gliatti found this patch fixed the issue:

diff --git a/vendor/github.com/go-ldap/ldap/v3/gssapi/client.go b/vendor/github.com/go-ldap/ldap/v3/gssapi/client.go
index c8f20a7..a7b1994 100644
--- a/vendor/github.com/go-ldap/ldap/v3/gssapi/client.go
+++ b/vendor/github.com/go-ldap/ldap/v3/gssapi/client.go
@@ -171,7 +171,7 @@ func (client *Client) InitSecContextWithOptions(target string, input []byte, APO
 // See RFC 4752 section 3.1.
 func (client *Client) NegotiateSaslAuth(input []byte, authzid string) ([]byte, error) {
        token := &gssapi.WrapToken{}
-       err := UnmarshalWrapToken(token, input, true)
+       err := token.Unmarshal(input, true)
        if err != nil {
                return nil, err
        }

Can you confirm ?