[Date Prev][Date Next] [Chronological] [Thread] [Top]

Trying to get passthrough auth working with OpenLDAP and Kerberos

For the last two weeks I have been on a sojourn through the wonderful
world of LDAP, Kerberos, and SASL, which has had me banging my head
against the desk more often than not. Today I'm finally crying uncle and
asking for some help.

We're running Centos 5.4, currently with OpenLDAP for user info and
Kerberos for authentication, but we want to be able to use LDAP for
authentication on a bunch of devices that can't use Kerberos natively.
So I've been trying to get the passthrough auth working. So far, I think
I've made a lot of progress, but I've run into a wall. Kerberos and LDAP
are working in my testbed, and I can kinit and do an ldapwhoami no
problem. testsaslauthd also gives me a success when I run it. However,
when try to do a simple bind:

[chas@ldapsandbox]$ ldapwhoami -x -D
'uid=chas,ou=People,dc=test,dc=domain' -W
Enter LDAP Password: 
ldap_bind: Invalid credentials (49)

syslog shows this:

2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: conn=6 fd=15 ACCEPT
from IP= (IP=
2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: conn=6 op=0 BIND
dn="uid=chas,ou=People,dc=test,dc=domain" method=128
2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: SASL [conn=6]
Failure: cannot connect to saslauthd server: No such file or directory
2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: conn=6 op=0 RESULT
tag=97 err=49 text=
2012-01-25T12:04:55-08:00 ldapsandbox slapd[14363]: conn=6 fd=15 closed
(connection lost)

Meanwhile, the saslauthd I'm running with /usr/sbin/saslauthd -a
kerberos5 -d doesn't even show a connection or anything to the console.
Any idea why it can't connect to the saslauthd server?

Here's my OpenLDAP slapd.conf:

include		/etc/openldap/schema/core.schema
include		/etc/openldap/schema/cosine.schema
include		/etc/openldap/schema/inetorgperson.schema
include		/etc/openldap/schema/nis.schema
allow bind_v2
pidfile		/var/run/openldap/slapd.pid
argsfile	/var/run/openldap/slapd.args

TLSCACertificateFile /etc/openldap/cacert.crt
TLSCertificateFile /etc/openldap/ldapsandbox.crt
TLSCertificateKeyFile /etc/openldap/ldapsandbox.key

authz-regexp uid=([^/]*),cn=gssapi,cn=auth uid=

access to *
	by dn.regex="uid=.*/admin,cn=GSSAPI,cn=auth" write
	by * read

database	bdb
suffix		"dc=test,dc=domain"

directory	/var/lib/ldap

index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub

And here's my /etc/sasl2/slapd.conf:

pwcheck_method: saslauthd
saslauthd_path: /var/run/sasl2/mux

Any ideas?