RE: Postfix 2.0.16 CRAM/DIGEST-MD5 SMTP AUTH

["Howard Chu" <hyc@symas.com>]

> -----Original Message-----
> From: owner-openldap-software@OpenLDAP.org
> [mailto:owner-openldap-software@OpenLDAP.org]On Behalf Of Tony Earnshaw

> Tony Earnshaw wrote:
> > SASL/DIGEST-MD5 authentication started
> > ldap_sasl_interactive_bind_s: Insufficient access (50)
> >     additional info: SASL(-14): authorization failure: not authorized
> >
> > I wonder why. You've already got me reading the relevant bits of
> > ldapsearch and slapd.conf, so that I now understand better
> > what's going on and why.
>
> Reading the Admin guide (right at the end) really does work
> wonders. How
> many times have I urged others to do so?
>
> Now if I do:
>
> sasl-regexp uid=(.*),cn=.*,cn=auth
> "ldap:///dc=billy,dc=demon,dc=nl??sub?uid=admin";
>
> instead of
>
> sasl-regexp uid=(.*),cn=.*,cn=auth
> "ldap:///dc=billy,dc=demon,dc=nl??sub?uid=$1";
>
> ldapsearch  -ZZ -Y digest-md5 -U admin -X u:tonni -H ldap:/// -w
> adminpassword 'objectclass=*' dn
>
> works. For some reason, the regexp $1 isn't working.

No..... The regexp is fine, your "admin" user doesn't have proxy
authorization privileges.

Try using ldapwhoami, you'll see that your setup (without the regexp $1) is
now incorrect.
  ldapwhoami  -ZZ -Y digest-md5 -U admin -X u:tonni -H ldap:///

> And Howard's ldapdb auxprop 1.9 still doesn't work, get the
> same fault.

The ldapdb auxprop requires proxy authorization privileges, as it states in
the README file.

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support