[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: ldapdb broken with sasl-2.1.19? (somewhat cleared up)




On Wed, 11 Aug 2004, paul k wrote:

Igor Brezac wrote:

How do you know the plugin is not working? Have you tested the plugin with the sample client and server software that comes with cyrus-sasl ($cyrus-sasl-src/sample)?

Hi Igor, Dieter thanks for your answers.

Well, I have to confess: I didn't tested but "trusted" the error message. Now after testing with ldapwhoami and postfix I can say it actually works as long as you do not use regexp's in saslAuthzTo: attribute (had same problem with 2.2.12+sasl-2.1.18)


It works for me. saslAuthzTo regexp needs to be saslAuthzTo: dn.regex:<your regexp>

-Igor

those -1 logs show the problem:

autzTo errors:

Aug 11 13:41:29 holzkopp slapd[12690]: ==>slap_sasl_check_authz: does uid=pkoelle,ou=users,dc=holzkopp,dc=b17 match saslAuthzTo rule in cn=ldapadmin,ou=adminusers,dc=holzkopp,dc=b17?
Aug 11 13:41:29 holzkopp slapd[12690]: => bdb_entry_get: ndn: "cn=ldapadmin,ou=adminusers,dc=holzkopp,dc=b17"
Aug 11 13:41:29 holzkopp slapd[12690]: => bdb_entry_get: oc: "(null)", at: "saslAuthzTo"
Aug 11 13:41:29 holzkopp slapd[12690]: bdb_dn2entry("cn=ldapadmin,ou=adminusers,dc=holzkopp,dc=b17")
Aug 11 13:41:29 holzkopp slapd[12690]: bdb_entry_get: rc=0
Aug 11 13:41:29 holzkopp slapd[12690]: ===>slap_sasl_match: comparing DN uid=pkoelle,ou=users,dc=holzkopp,dc=b17 to rule uid=[^,]+,ou=users,dc=holzkopp,dc=b17
Aug 11 13:41:29 holzkopp slapd[12690]: slap_parseURI: parsing uid=[^,]+,ou=users,dc=holzkopp,dc=b17
Aug 11 13:41:29 holzkopp slapd[12690]: >>> dnNormalize: <uid=[^,]+,ou=users,dc=holzkopp,dc=b17>
Aug 11 13:41:29 holzkopp slapd[12690]: <===slap_sasl_match: comparison returned 21
Aug 11 13:41:29 holzkopp slapd[12690]: <==slap_sasl_check_authz: saslAuthzTo check returning 48
Aug 11 13:41:29 holzkopp slapd[12690]: <== slap_sasl_authorized: return 48
Aug 11 13:41:29 holzkopp slapd[12690]: <= get_ctrls: n=1 rc=47 err="not authorized to assume identity"


or:
Aug 11 13:59:58 holzkopp slapd[12594]: ===>slap_sasl_match: comparing DN uid=pkoelle,ou=users,dc=holzkopp,dc=b17 to rule uid=.*,ou=users,dc=holzkopp,dc=b17
Aug 11 13:59:58 holzkopp slapd[12594]: slap_parseURI: parsing uid=.*,ou=users,dc=holzkopp,dc=b17
Aug 11 13:59:58 holzkopp slapd[12594]: >>> dnNormalize: <uid=.*,ou=users,dc=holzkopp,dc=b17>
Aug 11 13:59:58 holzkopp slapd[12594]: <<< dnNormalize: <uid=.*,ou=users,dc=holzkopp,dc=b17>
Aug 11 13:59:58 holzkopp slapd[12594]: <===slap_sasl_match: comparison returned 48



success:
Aug 11 13:51:00 holzkopp slapd[12593]: ===>slap_sasl_match: comparing DN uid=pko
elle,ou=users,dc=holzkopp,dc=b17 to rule uid=[^,]+,ou=users,dc=holzkopp,dc=b17
Aug 11 13:51:00 holzkopp slapd[12593]: slap_parseURI: parsing uid=[^,]+,ou=users,dc=holzkopp,dc=b17
Aug 11 13:51:00 holzkopp slapd[12593]: >>> dnNormalize: <uid=[^,]+,ou=users,dc=holzkopp,dc=b17>
Aug 11 13:51:00 holzkopp slapd[12593]: <===slap_sasl_match: comparison returned21
Aug 11 13:51:00 holzkopp slapd[12593]: ===>slap_sasl_match: comparing DN uid=pkoelle,ou=users,dc=holzkopp,dc=b17 to rule uid=pkoelle,ou=users,dc=holzkopp,dc=b17
Aug 11 13:51:00 holzkopp slapd[12593]: slap_parseURI: parsing uid=pkoelle,ou=users,dc=holzkopp,dc=b17
Aug 11 13:51:00 holzkopp slapd[12593]: >>> dnNormalize: <uid=pkoelle,ou=users,dc=holzkopp,dc=b17>
Aug 11 13:51:00 holzkopp slapd[12593]: <<< dnNormalize: <uid=pkoelle,ou=users,dc=holzkopp,dc=b17>
Aug 11 13:51:00 holzkopp slapd[12593]: <===slap_sasl_match: comparison returned
0


BTW: the log output from slapd is getting *really* useful. I cannot say if its me getting used to it or if it actually improved.

greetings
Paul


-- Igor