[Date Prev][Date Next]
Re: can't get slapd to do pass-through authentication
Quanah Gibson-Mount wrote:
--On Thursday, August 05, 2010 2:00 PM -0700 Brent Bice <email@example.com>
I also notice when I
export this record as an LDIF file the userPassword attribute has been
This is not a hash. This is base64 encoding, as has been discussed a
few thousand times on this list. ;) You simply need to decode it to see
the actual value. This is per RFC.
(slaps forehead) I realized that a bit after I sent the email. I
was thinking perhaps I didn't have the userPassword set right to
convince slapd to use SASL pass-through authentication, but... it is set
right so I still don't know why it's not contacting saslauthd. Hmph.
Dan White wrote:
See if you can find out what --with-configdir option was passed to your
cyrus sasl ./configure when it was compiled, which defaults to
/usr/lib/sasl2 (regardless of where the libraries are actually installed).
I built all the sasl, openldap, openssl, zlib, etc from source. On
all of them I set a --prefix to the same place (a directory containing
this version of our LDAP server binaries). So I didn't specify a
--with-configdir option but I'd expect it'd default to the
Aha! The config.status file contains this, however:
So perhaps it's not using my prefix_dir/lib/sasl2/slapd.conf file.
I'll drop something in /usr/lib/sasl2 just to see if this is the case or
I'll rebuild using an explicit --with-configdir.
If you were not creating it in the correct location, then libsasl would
default to using sasldb auxprop for authentication. You could create a test
saslpasswd -c bbice
to see if sasldb is being used.
I don't think testsaslauthd uses libsasl itself, so if none of that works,
you may still need to verify your libsasl is installed and linked
correctly. sample-server and sample-client might help (create a
You might also try a direct SASL bind against the server to see if that
works. Add 'sasl-secprops none' to your slapd.conf, then do:
ldapwhoami -Y PLAIN -U bbice ...
which should also use saslauthd to authenticate, with pwcheck_method:
Thanks for the tips! I'll try these out too.