[Date Prev][Date Next]
Re: openldap+sasl confusion
Seau Yeen Su wrote:
> 1. After using saslpasswd2 to create the username and password in sasl
> database, do i need to add the entry into ldap database with slappasswd
> command? When i used slapadd command and it prompts for password, does
> it authenticate against sasl database or ldap database?
I assume you're talking about SASL bind with password-based mechs.
It depends whether you want in-directory passwords (mainly userPassword
with clear-text password as attribute value) or not.
> 2. Do i need to issue saslpasswd2 for each and every user that i want to
> add into ldap database and to be authenticated via ldap?
Only if you don't store the passwords in the directory.
> 3. In the slapd.conf file, under rootpw, am i supposed to use the word
> "secret" or the cleartext password that i keyed in using saslpasswd2 or
> some encrypted password?
As values for attribute userPassword rootpw can be hashed or clear-text.
If you also want to bind as rootdn with SASL bind with mech CRAM-MD5 or
DIGEST-MD5 then it has to be clear-text. Otherwise it can be hashed
(e.g. generated/hashed with command-line tool slappasswd).
> 4. What is the difference between sasl-regexp and authz-regexp?
authz-regexp is the recent keyword in slapd.conf for this.
> 5. Let's say i issued saslpasswd2 -c admin to create admin as the LDAP
> administrator. Does this mean in the slapd.conf, the rootdn should be
> admin or can it be another name, that will be mapped via
> sasl-regexp/authz-regexp? (Which does it use anyway between these 2 :
> sasl-regexp & authz-regexp?)
SASL bind with digest password mech only knows a plain user-ID. So you
need an appropriate authz-regexp in slapd.conf to map it to a DN of an
> > 6. Previously I set up without sasl and it was rather straightforward,
> merely using slappasswd and save the encyrpted pasword into slapd.conf.
If you used a hashed password in rootpw and you did nothing else then I
doubt you could use that with SASL/DIGEST-MD5 bind.
Don't forget to double check the access control rule for userPassword.
Should contain a clause to grant auth access to anyone.
access to attrs=userPassword
by group="cn=Password Admins,ou=Groups,ou=schulung" =wx
by self =wx
by * =x