[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: Re[2]: SASL MD5 - another try
Hi Alexander,
Am Fre, 2003-07-18 um 10.30 schrieb Alexander Lunyov:
> Hello Dieter,
>
> Friday, July 18, 2003, 11:35:05 AM, you wrote:
>
> >> In sasl-regexp was a typo. And also uppercase of DIGEST-MD5. Now
> >> i have
> >>
> >> ldap_sasl_interactive_bind_s: Internal (implementation specific) error (80)
> >> additional info: SASL(-13): user not found: no secret in
> >> database
> DK> Did you put the password in plaintext into the entry? Otherwise sasl
> DK> couldn't read it.
>
> Yes, i did. I'm using java LDAPBrowser by Jarek Gawor - it's
> plaintext.
>
> >> And with -d -1 in the log i don't see, that sasl-regexp are even
> >> touched - it something like searches for user in sasldb only, but
> >> that's not what i'm expecting :( All in vain :(
> DK> saslRegexp are loaded into cache when starting slapd, so you probabely
> DK> would not see any debugging output. But you could use strace or
> DK> whatever you use on your system to follow system calls.
>
> Hmm... Maybe i should try it.
>
> >> Once again - now with SASL working - should i compile ldapdb
> >> auxprop plugin? The only thing i want is to get rid of sasldb and,
> >> as it said in Admin's Guide, store secrets in LDAP itself. Or
> >> should i somehow modify LDAP structure? Or should i do what?
> DK> auxprop is only used for auxiliary databases like mySQL or posgresql.
> DK> Quite frankly I'm a bit lost now, as it works fine for me, with
> DK> userid's and credetials either stored in sasldb or in openldap, and I
> DK> didn't do any specific modifications.
>
> Not only, there is auxprop plugin for LDAP, and i have to try it -
> i'll tell you if i fail or win in this case.
>
> >> How to store secrets in LDAP?
> DK> You may use ldappasswd, or create an *.ldif file, or use a graphical
> DK> tool like GQ or Ldapbrowser.
>
> No, i mean how to store SASL secrets in LDAP DB? Maybe i should do
> some configuration over SASL?
It just struck my mind, that your problem might be a sasl realm.
As default, sasl takes host.domain.tld als realm, unless defined
otherwise.
Could you test with the cyrus-sasl test suite, if the sasl
authentification string contains the sasl-realm, you provide in your
saslRegexp?
-Dieter
--
Dieter Kluenter | Systemberatung
Tel:040.64861967 | Fax: 040.64891521
mailto: dkluenter(at)dkluenter.de
http://www.avci.de