Re: Slave SASL Cannonicalize always returns root?

[johnh@primebuchholz.com]

I *meant* to, but had a typo in the script.

Fixing this gets me much farther - as shown below.  How do I get 
slap_sasl_getdn to return uid=Replicator,cn=mydomain.com,cn=gssapi,cn=auth 
so that my regex patten will convert it properly?  Should I just change 
the regex so uid=Replicator,cn=GSSAPI,cn=auth gets converted to my 
updatedn?

Thanks,

-John

<<< dnPrettyNormal: <cn=Replicator,dc=mydomain,dc=com>, 
<cn=replicator,dc=mydomain,dc=com>
do_sasl_bind: dn (cn=Replicator,dc=mydomain,dc=com) mech GSSAPI
conn=0 op=3 BIND dn="cn=Replicator,dc=mydomain,dc=com" method=163
==> sasl_bind: dn="cn=Replicator,dc=mydomain,dc=com" mech=<continuing> 
datalen=65
SASL Canonicalize [conn=0]: authcid="Replicator"
slap_sasl_getdn: id=Replicator [len=10]
slap_sasl_getdn: u:id converted to uid=Replicator,cn=GSSAPI,cn=auth
>>> dnNormalize: <uid=Replicator,cn=GSSAPI,cn=auth>
=> ldap_bv2dn(uid=Replicator,cn=GSSAPI,cn=auth,0)
<= ldap_bv2dn(uid=Replicator,cn=GSSAPI,cn=auth,0)=0
=> ldap_dn2bv(272)
<= ldap_dn2bv(uid=replicator,cn=gssapi,cn=auth,272)=0
<<< dnNormalize: <uid=replicator,cn=gssapi,cn=auth>
==>slap_sasl2dn: converting SASL name uid=replicator,cn=gssapi,cn=auth to 
a DN
slap_sasl_regexp: converting SASL name uid=replicator,cn=gssapi,cn=auth
<==slap_sasl2dn: Converted SASL name to <nothing>
SASL Canonicalize [conn=0]: slapAuthcDN="uid=replicator,cn=gssapi,cn=auth"





Quanah Gibson-Mount <quanah@stanford.edu> 
02/16/2005 11:37 AM

To
johnh@mydomain.com
cc
openldap-software@openldap.org
Subject
Re: Slave SASL Cannonicalize always returns root?








--On Wednesday, February 16, 2005 11:31 AM -0500 johnh@primebuchholz.com 
wrote:

> Thanks for the reply Quanah.
>
> I have a script that runs every 4 hours on the master to keep
> Replicator's  ticket alive.  I can bind as Replicator no problem.
>
> [root@my-ldap1]# klist -t /etc/openldap/slurpd.krb5cache
> Ticket cache: FILE:/etc/openldap/slurpd.krb5cache
> Default principal: Replicator@MYDOMAIN.COM
>
> Valid starting     Expires            Service principal
> 02/16/05 08:00:01  02/17/05 08:00:01  krbtgt/MYDOMAIN.COM@MYDOMAIN.COM
>
>
> Seems OK to me...

When you start slurpd, do you point it to that ticket cache?  See the 
KRB5CCNAME environment variable.

My slurpd startup script looks like:

#!/sbin/sh
# /etc/init.d/slurpd -- Start slurpd.
# $Id: slurpd.init,v 1.10 2004/12/07 00:51:18 quanah Exp $
#

KRB5CCNAME="FILE:/tmp/ldap_replicator.tkt"
export KRB5CCNAME

case $1 in
start)
    echo "slurpd service starting."
    /usr/local/lib/slurpd -t /var/tmp 1>/dev/console 2>&1
    ;;

stop)
        if test "$SLURPDPID"
        then
        kill -INT `cat /var/run/slurpd.pid`
                if [ -f $SLURPDPID ]; then
                  /usr/bin/rm /var/run/slurpd.pid
                fi
        fi
    ;;

*)
    echo "Usage: /etc/init.d/slurpd { start | stop }"
    ;;
esac


--Quanah

--
Quanah Gibson-Mount
Principal Software Developer
ITSS/Shared Services
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html

"These censorship operations against schools and libraries are stronger
than ever in the present religio-political climate. They often focus on
fantasy and sf books, which foster that deadly enemy to bigotry and blind
faith, the imagination." -- Ursula K. Le Guin