[Date Prev][Date Next]
Re: can't get slapd to do pass-through authentication
Many thanks to everyone here. I've got it working now. The first
part of the solution was finding out (thanks Dan!) that cyrus-sasl
doesn't use prefix_dir/lib/sasl2/slapd.conf when you build from source
unless you explicitly set --with-configdir (Aha!).
After temporarily linking /usr/lib/sasl2 to my prefix_dir/lib/sasl2,
it still wasn't working but that was because I'd messed with so many
different settings in the sasl slapd.conf. Re-reading the openldap docs
on pass-thru authentication and going back to this worked:
Dan White wrote:
On 05/08/10 14:00 -0700, Brent Bice wrote:
I created a lib/sasl2/slapd.conf file again and in it specified:
If testsaslauth works without specifying a '-f' option, then you
need to specify saslauthd_path.
I didn't think so either. I put it in just in case slapd was
trying to figure out where the socket was by reading this file.
Is that /usr/lib/sasl2/slapd.conf?
See if you can find out what --with-configdir option was passed to your
cyrus sasl ./configure when it was compiled, which defaults to
/usr/lib/sasl2 (regardless of where the libraries are actually installed).
If you were not creating it in the correct location, then libsasl would
default to using sasldb auxprop for authentication. You could create a test
saslpasswd -c bbice
to see if sasldb is being used.
I don't think testsaslauthd uses libsasl itself, so if none of that works,
you may still need to verify your libsasl is installed and linked
correctly. sample-server and sample-client might help (create a
You might also try a direct SASL bind against the server to see if that
works. Add 'sasl-secprops none' to your slapd.conf, then do:
ldapwhoami -Y PLAIN -U bbice ...
which should also use saslauthd to authenticate, with pwcheck_method: