Hello,
I try to do the authentication in LDAP via Kerberos. The
Kerberos-Database is in LDAP, no problem, I can login to the system as a
normal user but when I do a "ldapwhomami" I get the following output:
-----------------
u1-verw@ldapserver:~$ ldapwhoami
SASL/GSSAPI authentication started
SASL username: u1-verw@EXAMPLE.NET
SASL SSF: 256
SASL data security layer installed.
dn:uid=u1-verw,cn=gssapi,cn=auth
-----------------
I would like to get the original DN from the user not the
dn:*,cn=gssapi,cn=auth. So I put into my configuration:
-----------------
olcAuthzRegexp: {0}uid=(.+),cn=gssapi,cn=auth
ldap:///dc=example,dc=net??sub?(uid=$1)
-----------------
But still the same. The log-output:
-----------------
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 fd=37 ACCEPT from
IP=192.168.56.60:59276 (IP=0.0.0.0:636)
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 fd=37 TLS established
tls_ssf=256 ssf=256
Dec 20 14:42:34 ldapserver ldapwhoami[1914]: GSSAPI client step 1
Dec 20 14:42:34 ldapserver ldapwhoami[1914]: GSSAPI client step 1
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=0 BIND dn="" method=163
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=0 RESULT tag=97
err=14 text=SASL(0): successful result:
Dec 20 14:42:34 ldapserver ldapwhoami[1914]: GSSAPI client step 1
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=1 BIND dn="" method=163
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=1 RESULT tag=97
err=14 text=SASL(0): successful result:
Dec 20 14:42:34 ldapserver ldapwhoami[1914]: GSSAPI client step 2
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=2 BIND dn="" method=163
Dec 20 14:42:34 ldapserver slapd[493]: => access_allowed: auth access to
"dc=example,dc=net" "entry" requested
Dec 20 14:42:34 ldapserver slapd[493]: => dn: [1]
Dec 20 14:42:34 ldapserver slapd[493]: => dn: [2] cn=subschema
Dec 20 14:42:34 ldapserver slapd[493]: => dn: [3] dc=example,dc=net
Dec 20 14:42:34 ldapserver slapd[493]: => acl_get: [3] matched
Dec 20 14:42:34 ldapserver slapd[493]: => acl_get: [3] attr entry
Dec 20 14:42:34 ldapserver slapd[493]: => acl_mask: access to entry
"dc=example,dc=net", attr "entry" requested
Dec 20 14:42:34 ldapserver slapd[493]: => acl_mask: to all values by "",
(=0)
Dec 20 14:42:34 ldapserver slapd[493]: <= check a_dn_pat: users
Dec 20 14:42:34 ldapserver slapd[493]: <= check a_dn_pat: *
Dec 20 14:42:34 ldapserver slapd[493]: <= acl_mask: [2] applying
none(=0) (stop)
Dec 20 14:42:34 ldapserver slapd[493]: <= acl_mask: [2] mask: none(=0)
Dec 20 14:42:34 ldapserver slapd[493]: => slap_access_allowed: auth
access denied by none(=0)
Dec 20 14:42:34 ldapserver slapd[493]: => access_allowed: no more rules
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=2 BIND
authcid="u1-verw" authzid="u1-verw"
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=2 BIND
dn="uid=u1-verw,cn=gssapi,cn=auth" mech=GSSAPI sasl_ssf=256 ssf=256
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=2 RESULT tag=97
err=0 text=
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=3 EXT
oid=1.3.6.1.4.1.4203.1.11.3
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=3 WHOAMI
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=3 RESULT oid= err=0
text=
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=4 UNBIND
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 fd=37 closed
Dec 20 14:42:34 ldapserver ldapwhoami[1914]: DIGEST-MD5 common mech free
-----------------
The output is with log-level "acl".
When I add the rule:
-----------------
olcAccess: {1}to * by * read
-----------------
ldapwhoami is working like I expected it:
-----------------
u1-verw@ldapserver:~$ ldapwhoami
SASL/GSSAPI authentication started
SASL username: u1-verw@EXAMPLE.NET
SASL SSF: 256
SASL data security layer installed.
dn:cn=u1 verw,ou=users,ou=verwaltung,ou=firma,dc=example,dc=net
-----------------
The log is showing:
-----------------
Dec 20 14:46:48 ldapserver slapd[493]: conn=1086 fd=37 ACCEPT from
IP=192.168.56.60:59280 (IP=0.0.0.0:636)
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 fd=37 TLS established
tls_ssf=256 ssf=256
Dec 20 14:46:49 ldapserver ldapwhoami[1941]: GSSAPI client step 1
Dec 20 14:46:49 ldapserver ldapwhoami[1941]: GSSAPI client step 1
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=0 BIND dn="" method=163
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=0 RESULT tag=97
err=14 text=SASL(0): successful result:
Dec 20 14:46:49 ldapserver ldapwhoami[1941]: GSSAPI client step 1
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=1 BIND dn="" method=163
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=1 RESULT tag=97
err=14 text=SASL(0): successful result:
Dec 20 14:46:49 ldapserver ldapwhoami[1941]: GSSAPI client step 2
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=2 BIND dn="" method=163
Dec 20 14:46:49 ldapserver slapd[493]: => access_allowed: auth access to
"dc=example,dc=net" "entry" requested
Dec 20 14:46:49 ldapserver slapd[493]: => dn: [1]
Dec 20 14:46:49 ldapserver slapd[493]: => acl_get: [2] attr entry
Dec 20 14:46:49 ldapserver slapd[493]: => acl_mask: access to entry
"dc=example,dc=net", attr "entry" requested
Dec 20 14:46:49 ldapserver slapd[493]: => acl_mask: to all values by "",
(=0)
Dec 20 14:46:49 ldapserver slapd[493]: <= check a_dn_pat: *
Dec 20 14:46:49 ldapserver slapd[493]: <= acl_mask: [1] applying
read(=rscxd) (stop)
Dec 20 14:46:49 ldapserver slapd[493]: <= acl_mask: [1] mask: read(=rscxd)
Dec 20 14:46:49 ldapserver slapd[493]: => slap_access_allowed: auth
access granted by read(=rscxd)
Dec 20 14:46:49 ldapserver slapd[493]: => access_allowed: auth access
granted by read(=rscxd)
Dec 20 14:46:49 ldapserver slapd[493]: => access_allowed: auth access to
"cn=u1 Verw,ou=users,ou=Verwaltung,ou=firma,dc=example,dc=net" "uid"
requested
Dec 20 14:46:49 ldapserver slapd[493]: => dn: [1]
Dec 20 14:46:49 ldapserver slapd[493]: => acl_get: [2] attr uid
Dec 20 14:46:49 ldapserver slapd[493]: => acl_mask: access to entry
"cn=u1 Verw,ou=users,ou=Verwaltung,ou=firma,dc=example,dc=net", attr
"uid" requested
Dec 20 14:46:49 ldapserver slapd[493]: => acl_mask: to value by "", (=0)
Dec 20 14:46:49 ldapserver slapd[493]: <= check a_dn_pat: *
Dec 20 14:46:49 ldapserver slapd[493]: <= acl_mask: [1] applying
read(=rscxd) (stop)
Dec 20 14:46:49 ldapserver slapd[493]: <= acl_mask: [1] mask: read(=rscxd)
Dec 20 14:46:49 ldapserver slapd[493]: => slap_access_allowed: auth
access granted by read(=rscxd)
Dec 20 14:46:49 ldapserver slapd[493]: => access_allowed: auth access
granted by read(=rscxd)
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=2 BIND
authcid="u1-verw" authzid="u1-verw"
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=2 BIND dn="cn=u1
verw,ou=users,ou=verwaltung,ou=firma,dc=example,dc=net" mech=GSSAPI
sasl_ssf=256 ssf=256
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=2 RESULT tag=97
err=0 text=
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=3 EXT
oid=1.3.6.1.4.1.4203.1.11.3
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=3 WHOAMI
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=3 RESULT oid= err=0
text=
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=4 UNBIND
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 fd=37 closed
Dec 20 14:46:49 ldapserver ldapwhoami[1941]: DIGEST-MD5 common mech free
-----------------
So it must have something to with ACLs. I can't figure out where to set
the permission to get everything working without opening my ldap for
everyone. I tried a lot:
-----------------
by dn.regex=authzid="(.+)" read
or
by dn.regex=authcid="(.+)" read
or
by dn.regex=uid=(.+),cn=gssapi,cn=auth read
-----------------
Non of the above is working.
Any hint?
Stefan
l
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature