Re: Got error while enabling SASL

[Gaurav Gugnani <gugnanigaurav@gmail.com>]

Hello All,

Thks for helping me out, however i'm still stuck in middle of it and the issue has not yet resolved.

Error:
/u01/app/openldap/product/2.4.26/etc/openldap>ldapsearch -Y DIGEST-MD5 -U sasluser7 -b 'o=xyz'
SASL/DIGEST-MD5 authentication started
Please enter your password:
ldap_sasl_interactive_bind_s: Invalid credentials (49)
        additional info: SASL(-13): user not found: no secret in database

I checked for ACL and also now i'm using authz with following lines:

authz-regexp uid=([^,]*),cn=DIGEST-MD5,cn=auth uid=$1,ou=System,o=xyz

access to attrs="userpassword"
        by self write
        by anonymous auth
        by dn="uid=sasluser7,ou=System,o=xyz" read
access to dn.base="o=xyz"
        by dn="uid=sasluser7,ou=System,o=xyz" read
        by users read
access to dn.subtree="ou=Subscribers,o=xyz"
        by dn="uid=sasluser7,ou=System,o=xyz" read
access to *
        by self write
        by dn="uid=sasluser7,ou=System,o=xyz" read
        
I hope it is fine.

Moreover, we can say that the user is created:
/u01/app/openldap/product/2.4.26/etc/openldap>ldapsearch -x -W -D 'cn=manager,o=xyz' -b 'uid=sasluser7,ou=System,o=xyz'
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <uid=sasluser7,ou=System,o=xyz> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# sasluser7, System, xyz
dn: uid=sasluser7,ou=System,o=xyz
uid: sasluser7
ou: System
description: Special account for SASL Testing
userPassword:: c2FzbVHzZXI3
objectClass: account
objectClass: simpleSecurityObject

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

Also, i would like to highlight one thing:

That when i check for sasl dblist users - it thorws me an error. Can that be an issue point?
/u01/app/openldap/product/2.4.26/etc/openldap>sasldblistusers
-bash: sasldblistusers: command not found

Please help me out in moving forward. Thks a lot for your support.

Regards,
Gaurav Gugnani

On Fri, Feb 3, 2012 at 8:44 PM, Dan White <dwhite@olp.net> wrote:

On 02/03/12 16:12 +0530, Gaurav Gugnani wrote:

Hello All,

I've installed the cyrus-sasl-md5-2.1.22-5.el5_4.3.x86_64.rpm package.

*Logs:*

/root>pluginviewer

Installed SASL (server side) mechanisms are:

*CRAM-MD5 ANONYMOUS DIGEST-MD5 PLAIN LOGIN EXTERNAL*

......


**

/u01/app/openldap/product/2.4.26/etc/openldap>ldapsearch -x  -b "" -s base
-LLL supportedSASLMechanisms
dn:

*supportedSASLMechanisms: CRAM-MD5
supportedSASLMechanisms: DIGEST-MD5**

*
and again started with SASL process (tried several times) but everytime...
got an error:

*Steps i followed:*

1> saslpasswd2 -c sasluser3
2> sasldblistusers2

These two steps are not necessary.

3> Stop LDAP
4> edit slapd.conf and add following lines:
  password-hash   {CLEARTEXT}
  sasl-regexp uid=(.*),cn=DIGEST-MD5,cn=auth uid=$1,ou=System,o=xyz
5> Start LDAP
6> Add account from ldif:
add_sasl_accnt3.ldif
----------------------------
# TEST Account for SASL:
dn: uid=sasluser3,ou=System,o=xyz
uid: sasluser3
ou: System
description: Special account for SASL Testing
userPassword: sasluser3
objectClass: account
objectClass: simpleSecurityObject
7> ldapadd -x -D cn=Manager,o=xyz -W -f add_sasl_accnt3.ldif

8> *ldapsearch -Y DIGEST-MD5 -U sasluser3 -b 'o=xyz'*
   Or
  *ldapsearch -U sasluser5 -b 'o=xyz'*

But evrytime got error as:
SASL/DIGEST-MD5 authentication started
Please enter your password:
ldap_sasl_interactive_bind_s: Invalid credentials (49)
      additional info: SASL(-13): user not found: no secret in database

This is an error indicating that the user entry within ldap could not be
found, and two possible reasons are you do not have ACLs configured
properly, or your sasl-regexp is misconfigured.

Depending on the version of slapd, 'sasl-regexp' should instead be
'authz-regexp'. It appears from the output below that you are using version
2.4.26, so you should using 'authz-regexp'.

For documentation on configuring them, reference the OpenLDAP 2.4 Admin
Guide.

For trouble shooting ACL misconfigurations, try running slapd in debug
mode, or increase your logging.

On Thu, Feb 2, 2012 at 11:13 PM, Gaurav Gugnani <gugnanigaurav@gmail.com>wrote:

Hello,

Thks for helping me out. Yes, the package is missing.

The O/P of plugin viewer:
/u01/app/openldap/product/2.4.26/etc/openldap>pluginviewer
Installed SASL (server side) mechanisms are:
ANONYMOUS PLAIN LOGIN EXTERNAL

--
Dan White