[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: can't get slapd to do pass-through authentication

Many thanks to everyone here. I've got it working now. The first part of the solution was finding out (thanks Dan!) that cyrus-sasl doesn't use prefix_dir/lib/sasl2/slapd.conf when you build from source unless you explicitly set --with-configdir (Aha!).

After temporarily linking /usr/lib/sasl2 to my prefix_dir/lib/sasl2, it still wasn't working but that was because I'd messed with so many different settings in the sasl slapd.conf. Re-reading the openldap docs on pass-thru authentication and going back to this worked:
mech_list: plain
pwcheck_method:	saslauthd
saslauthd_path:	/var/state/saslauthd/mux
sasl-secprops: none


Dan White wrote:
On 05/08/10 14:00 -0700, Brent Bice wrote:
   I created a lib/sasl2/slapd.conf file again and in it specified:
pwcheck_method:    saslauthd
saslauthd_path:    /var/state/saslauthd/mux

If testsaslauth works without specifying a '-f' option, then you shouldn't
need to specify saslauthd_path.

I didn't think so either. I put it in just in case slapd was trying to figure out where the socket was by reading this file.

Is that /usr/lib/sasl2/slapd.conf?

See if you can find out what --with-configdir option was passed to your
cyrus sasl ./configure when it was compiled, which defaults to
/usr/lib/sasl2 (regardless of where the libraries are actually installed).

If you were not creating it in the correct location, then libsasl would
default to using sasldb auxprop for authentication. You could create a test

saslpasswd -c bbice

to see if sasldb is being used.

I don't think testsaslauthd uses libsasl itself, so if none of that works,
you may still need to verify your libsasl is installed and linked
correctly. sample-server and sample-client might help (create a

You might also try a direct SASL bind against the server to see if that
works. Add 'sasl-secprops none' to your slapd.conf, then do:

ldapwhoami -Y PLAIN -U bbice ...

which should also use saslauthd to authenticate, with pwcheck_method: