[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Syncrepl authentication via GSSAPI/SASL/Kerberos



--On Tuesday, September 30, 2014 2:14 PM -0400 Steven Presser <steve@pressers.name> wrote:

Hi,

I'm running a pair of OpenLDAP servers on a network which primarily uses
kerberos for authentication.  The two servers replicate data (via a
simple syncrepl master-slave setup).  Right now, they're using simple
authentication.  I'd like to move them to using kerberos authentication.

I've successfully gotten them to the point where the kerberos
authentication (appears) to succeed.  However, replication doesn't happen
with the mysterious error "findbase failed! 32".  I have found no mention
of this error, other than a couple of permissions-related errors.  I
double-checked my permissions, so it's not that.

I've copied relevant portions of my slapd.conf below and would be happy
to provide more if required.  I also have a syslog excerpt below.

Does anyone know what I should be looking at next or have an example of a
functional setup similar to what I've described?

It doesn't look like you've set up SASL regexp's correctly or you didn't define your ACLs correctly for the SASL bind ID:

Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=2 BIND authcid="ldap/mordor.pressers.name" authzid="ldap/mordor.pressers.name" Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=2 BIND dn="uid=ldap/mordor.pressers.name,cn=gssapi,cn=auth" mech=GSSAPI sasl_ssf=56 ssf=56

As you can see, your replication DN was:

       binddn="cn=repl,dc=pressers,dc=name"

--Quanah



--

Quanah Gibson-Mount
Server Architect
Zimbra, Inc.
--------------------
Zimbra ::  the leader in open source messaging and collaboration