Implement GSSAPIBindRequest in the LDAP Realm

[sachinfrayne]

Describe the feature: Implement the GSSAPIBindRequest in the LDAP Realm to enable Elasticsearch to use a Kerberos keytab file to authenticate against the LDAP service instead of a username and password.

[elasticmachine]

Pinging @elastic/es-security

[bizybot]

I started my investigations to support GSSAPIBindRequest, but I think we have more to this user story.
IMO we should also consider support for SASL mechanisms supported by AD/LDAP like EXTERNAL, GSSAPI (not considering least secure options to reduce the number of supported mechanisms)
Right now we only support SimpleBindRequest and sometimes this may not be available in the enterprise.
Thoughts? @tvernum @jaymode

[jaymode]

What is your concrete proposal? Have you seen requests for those features? Do you have a plan to test those features? Just because the library we use supports it, doesn't mean we need to. It is always easier to add code later on than it is to remove it.

[bizybot]

Except for the support of GSSAPIBindRequest, we do not have any requests to support other SASL mechanisms.
Initially I did thought about adding support for others but then testing all of the mechanisms is behemoth.
+1 on avoiding adding code if we do not need it now.

My proposal is to build the BindRequest as per the configuration and have a builder which does the switch based on the configured mode. This way we can just add another builder to support other SASL mechanism in future, something like following:

public class BindRequestBuilder {
      BindRequest buildBindRequest(RealmConfig config) {
           BindRequest bindRequest = null;
           switch(mode) {
                case "simple":
                     bindRequest = SimpleBindRequestBuilder.build(config);
                     break;
                case "sasl_gssapi":
                     bindRequest = GSSAPIBindRequestBuilder.build(config);
                     break;
                 default:
                     throw new Unsupported...
           }
           return bindRequest;
      }
}

[blookot]

Hi team
do you have an update on this issue please?

[tvernum]

We currently do not have any plans to work on this.