[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: OpenLDAP session authentication

Hi Dan,

Thanks so much for your help.  I'm getting closer.

The ldapwhoami seems to work now.

erik@starfish:~/ldif$ ldapwhoami -U erik -H ldaps://localhost/
SASL/PLAIN authentication started
Please enter your password:
SASL username: erik

I can also run an ldapsearch to list the contents of my database:

erik@starfish:~/ldif$ ldapsearch -D 'uid=erik,cn=plain,cn=auth' -b
'ou=people, dc=lotspeich,dc=org' '(objectclass=*)' -H ldaps://localhost/
-W -Y plain
Enter LDAP Password:
SASL/PLAIN authentication started
SASL username: erik
# extended LDIF
# LDAPv3
# base <ou=people, dc=lotspeich,dc=org> with scope subtree
# filter: (objectclass=*)
# requesting: ALL

# people, lotspeich.org
dn: ou=people,dc=lotspeich,dc=org
objectClass: top
objectClass: organizationalUnit
ou: people
. *** DATA OMITTED! ***
# search result
search: 2
result: 0 Success

# numResponses: 136
# numEntries: 135

I have two questions/concerns:

1. If I leave the "-Y plain" option off of the argument list to
ldapsearch, I get "Invalid credentials":

erik@starfish:~/ldif$ ldapsearch -D 'uid=erik,cn=plain,cn=auth' -b
'ou=people, dc=lotspeich,dc=org' '(objectclass=*)' -H ldaps://localhost/ -W
Enter LDAP Password:
ldap_bind: Invalid credentials (49)

I have a configuration file in /usr/local/sasl2 for slapd.conf; I tried
adding one for ldapsearch:

root@starfish:/usr/lib/sasl2# cat ldapsearch.conf
pwcheck_method: saslauthd
mech_list: plain

This didn't seem to make a difference in allowing me to authenticate
without the "-Y" option.

2. I would like to use authenticated LDAP in Thunderbird.  I set
uid=erik,cn=plain,cn=auth as my Bind DN.  It asked for my password, but
always returned 'authentication failed'.

I don't know if #1 or #2 are related.  I know I must be missing
something.  From what I understand (which isn't much), I'm not using
simple bind, so I don't need the mappings in my configuration file that
you mentioned previously.



Dan White wrote:
> On 29/09/10 10:19 -0500, Erik Lotspeich wrote:
>> Hi Dan,
>> I hope that I don't mind if I ask a follow-up question:
>> root@starfish:/usr/local/etc/openldap# testsaslauthd -u erik -p XXX -s
>> slapd
>> 0: OK "Success."
>> That works, but when I run ldapwhami, it doesn't:
>> root@starfish:/usr/local/etc/openldap# ldapwhoami -Y login -U erik -H
>> ldap://localhost
>> ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
>>        additional info: SASL(-4): no mechanism available: No worthy
>> mechs found
>> I did a search on the internet, and I ran this command:
>> root@starfish:/usr/local/etc/openldap# ldapsearch -x -ZZ -s base -b ""
>> # extended LDIF
>> #
>> # LDAPv3
>> # base <> with scope baseObject
>> # filter: (objectclass=*)
>> # requesting: ALL
>> #
>> #
>> dn:
>> objectClass: top
>> objectClass: OpenLDAProotDSE
>> # search result
>> search: 3
>> result: 0 Success
>> In other examples I've seen, mechanisms such as PLAIN or LOGIN or listed
>> here.
> Make sure you have the appropriate sasl shared libraries installed on both
> your server and your client (which appears to be the same according to your
> examples from above).  Use plugingview/saslpluginviewer to see which
> server/client mechanisms you do have installed.
> For instance, on a Debian system you'd need to have the libsasl2-modules
> package.
> If you do have those mechanisms installed but are still not seeing them in
> the '-s base -b ""' search, make sure you've added 'sasl-secprops none' to
> your openldap slapd.conf.