>> Michael, >> >> Please excuse broken threading, your reply email got rejected cause sender IP was not in SPF record of the domain, though now its ok. >> >> >> Thanks for your feedback. I tried to use ldapwhoami, however it returned the same error "ldap_sasl_interactive_bind_s: Local error (-2)". >> >> Output with debug enabled: >> >> [root@oldp4-dk-vm ~]# ldapwhoami -H ldapi:/// -Y EXTERNAL -d 3 >> ldap_url_parse_ext(ldapi:///) >> ldap_create >> ldap_url_parse_ext(ldapi:///??base) >> ldap_sasl_interactive_bind: user selected: EXTERNAL >> ldap_int_sasl_bind: EXTERNAL >> ldap_new_connection 1 1 0 >> ldap_int_open_connection >> ldap_connect_to_path >> ldap_new_socket: 3 >> ldap_connect_to_path: Trying /usr/local/openldap/var/run/ldapi > >It seems you're using a local OpenLDAP build. > >So I'd try first: >/usr/local/openldap/bin/ldapwhoami -H ldapi:/// -Y EXTERNAL -d 3 > >Ciao, Michael. Michael, I am using the openldap from ltb (ltb-project.org), which installs under /usr/local/openldap. [root@oldp4-dk-vm openldap]# /usr/local/openldap/bin/ldapwhoami -H ldapi:/// -Y EXTERNAL -d 3 ldap_url_parse_ext(ldapi:///) ldap_create ldap_url_parse_ext(ldapi:///??base) ldap_sasl_interactive_bind: user selected: EXTERNAL ldap_int_sasl_bind: EXTERNAL ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_path ldap_new_socket: 3 ldap_connect_to_path: Trying /usr/local/openldap/var/run/ldapi ldap_connect_timeout: fd: 3 tm: -1 async: 0 ldap_ndelay_on: 3 ldap_ndelay_off: 3 ldap_msgfree ldap_err2string ldap_sasl_interactive_bind_s: Local error (-2) ldap_free_connection 1 1 ldap_send_unbind ber_flush2: 7 bytes to sd 3 ldap_write: want=7, written=7 0000: 30 05 02 01 01 42 00 0....B. ldap_free_connection: actually freed [root@oldp4-dk-vm openldap]# Noted that in /usr/local/openldap/etc/openldap/ldap.conf I had SASL_NOCANON set to on (it was copied over from RHEL7 openldap package). Removed it and SASL EXTERNAL works fine. [root@oldp4-dk-vm openldap]# /usr/local/openldap/bin/ldapwhoami -H ldapi:/// -Y EXTERNAL SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn:gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth [root@oldp4-dk-vm openldap]# Thanks a lot for all your help. Kenneth
Attachment:
smime.p7s
Description: S/MIME cryptographic signature