Re: pass-through authentication

To: openldap-technical@openldap.org

Subject: Re: pass-through authentication

From: Timothy Keith <timothy.g.keith@gmail.com>

Date: Wed, 30 Dec 2015 18:29:09 -0600

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=cHliE2CAeWVnbhSPW8xZirvKmKsBEfRc5VlJtdVlR6A=; b=IBYqfh0bvzVg8dT4V+hr9J0cLJDRVaT05ygnVU34H1qDv4anTbu4smHDaMMBTgwGkD Jg/54GWBEvun0B6c/t5cw4eJSpTPFK4WZhP955URYccsvf8bz8eXy7N2WW4QgHfJpWBU 4F+tpSdtp4LkdLcManhJW1Xy4NsjhiZr4/9xbpf1lHbhoa5Rnk1O0zqkd2gd8Ey3xqYe J1UqGWcdxb2gD/Fx33ZQhkg0EPXOwlspVPJgC4pc8G37DLrunnTyw7T0DAneEYeRsKB0 SYpp5OZcQrJEJb4xPpvJLuS9uc4cUiRd2tOGffV2TbcqXMRrwbzpMp8hPwBruCHsO7r6 hrBw==

In-reply-to: <CAGraDoGytxhecmFu3kXupsrAo8zrTgPbi8S204+TCU_MhkoRyw@mail.gmail.com>

References: <CAGraDoGD6=vJ-6JMK1OoWFLC92EFTa_QPMwJGTZ0FSM2vM7-ww@mail.gmail.com> <3C4F4F6D3838404E9575FC9C39B83928EB373594@SE-EX027.groupinfra.com> <CAGraDoFJ0dfGDNrc1wS3DU=0S09H0nNpA2qbXVx+cSBfYwEEQA@mail.gmail.com> <CAGraDoGytxhecmFu3kXupsrAo8zrTgPbi8S204+TCU_MhkoRyw@mail.gmail.com>

I'm still having troubles with pass-through SASL on RHEL

testsaslauthd produces this message :

0: NO "authentication failed"

With this in the system log :

saslauthd logs reason=Unknown

When saslauthd is launched in verbose mode and followed by testsaslauthd it prints :

connect() : No such file or directory

Tim

On Thu, Dec 24, 2015 at 1:46 PM, Timothy Keith <timothy.g.keith@gmail.com> wrote:

As per my ongoing LDAP SASL design question, can anyone recommend a good tutorial for pass-through authentication ?

Tim

On Tue, Dec 22, 2015 at 2:47 PM, Timothy Keith <timothy.g.keith@gmail.com> wrote:
Uwe, your assistance could be very helpful. I followed Open LDAP tutorials but could not determine why the SASL requests fail. I am a newcomer to LDAP.

Tim

On Mon, Dec 21, 2015 at 12:04 PM, Hering, Uwe <uwe.hering@cgi.com> wrote:
Hello Tim,

we have set up such a setup where one can authenticate against OpenLDAP which redirects the request via saslauthd/kerberos to an AD server. Within the AD a service account with corresponding keytab will be necessary.

If you are interested I can try to get the pieces of information together again.

Regards,

Uwe

-----Ursprüngliche Nachricht-----
Von: openldap-technical [mailto:openldap-technical-bounces@openldap.org] Im Auftrag von Timothy Keith
Gesendet: Freitag, 18. Dezember 2015 01:33
An: openldap-technical@openldap.org
Betreff: pass-through authentication

We are attempting to set up an LDAP server which will answer queries from an application. The database will contain metadata on a set of users in the application. The application will also query the server to authenticate the user’s password, however, this server will not house the password. That resides on another server, which our server
will query. We do not have administrative rights to the other
server.

The difficulty we are having now is setting up the pass-through authentication for the passwords. Any pointers in how to proceed with this would be greatly appreciated.

Regards,

Tim

Follow-Ups:

Re: pass-through authentication
- From: Timothy Keith <timothy.g.keith@gmail.com>
Re: pass-through authentication
- From: Dan White <dwhite@cafedemocracy.org>

References:

pass-through authentication
- From: Timothy Keith <timothy.g.keith@gmail.com>
AW: pass-through authentication
- From: "Hering, Uwe" <uwe.hering@cgi.com>