Dear Philip, Greg, Tony, Louis and the list,
Thanks for the guidance so far. I have got little success but still away from my target. here I'm describing every thing.
1> I have executed "saslpasswd2 admin" to create the user admin in the sasldb2
2> "sasldblistusers2" shows as below
admin@linux.kolkatainfoservices.in: userPassword
3> now the command *ldapsearch -H ldaps://* when asks the password I gave the admin password stored in sasldb2. and now it is working.
4> I may be allowed to provide the log here ======================================================= Mar 12 12:26:12 linux slapd[6783]: conn=2 fd=15 ACCEPT from IP=127.0.0.1:36689 (IP=0.0.0.0:636) Mar 12 12:26:12 linux slapd[6783]: conn=2 fd=15 TLS established tls_ssf=256 ssf=256 Mar 12 12:26:12 linux slapd[6783]: conn=2 op=0 SRCH base="" scope=0 deref=0 filter="(objectClass=*)" Mar 12 12:26:12 linux slapd[6783]: conn=2 op=0 SRCH attr=supportedSASLMechanisms Mar 12 12:26:12 linux slapd[6783]: conn=2 op=0 SEARCH RESULT tag=101 err=0 nentries=1 text= Mar 12 12:26:12 linux slapd[6783]: conn=2 op=1 BIND dn="" method=163 Mar 12 12:26:12 linux slapd[6783]: conn=2 op=1 RESULT tag=97 err=14 text= Mar 12 12:26:12 linux ldapsearch: DIGEST-MD5 client step 2 Mar 12 12:26:14 linux ldapsearch: DIGEST-MD5 client step 2 Mar 12 12:26:14 linux slapd[6783]: conn=2 op=2 BIND dn="" method=163 Mar 12 12:26:14 linux slapd[6783]: conn=2 op=2 BIND authcid="admin" authzid="admin" Mar 12 12:26:14 linux slapd[6783]: conn=2 op=2 BIND dn="uid=admin,cn=digest-md5,cn=auth" mech=DIGEST-MD5 ssf=128 Mar 12 12:26:14 linux slapd[6783]: conn=2 op=2 RESULT tag=97 err=0 text= Mar 12 12:26:14 linux ldapsearch: DIGEST-MD5 client step 3 Mar 12 12:26:14 linux slapd[6783]: conn=2 op=3 SRCH base="ou=Users,dc=kolkatainfoservices,dc=in" scope=2 deref=0 filter="(objectClass=*)" Mar 12 12:26:14 linux slapd[6783]: conn=2 op=3 SEARCH RESULT tag=101 err=0 nentries=7 text= Mar 12 12:26:14 linux slapd[6783]: conn=2 op=4 UNBIND Mar 12 12:26:14 linux slapd[6783]: conn=2 fd=15 closed ==============================================================
please note the ["uid=admin,cn=digest-md5,cn=auth" mech=DIGEST-MD5 ssf=128]
5> BUT when I added entry for Manager ( as per root dn) and provide the password of manager it is not working. even it is not working for any other uesrs which I have added in sasldb2.
How can I fix the problem ?
PS: here is my ldif as attachment
dn: dc=kolkatainfoservices,dc=in objectClass: domain dc: kolkatainfoservices structuralObjectClass: domain
dn: ou=adrbook-GER,dc=kolkatainfoservices,dc=in ou: adrbook-GER objectClass: top objectClass: organizationalUnit structuralObjectClass: organizationalUnit
dn: ou=adrbook-IND,dc=kolkatainfoservices,dc=in ou: adrbook-IND objectClass: top objectClass: organizationalUnit structuralObjectClass: organizationalUnit
dn: ou=Users,dc=kolkatainfoservices,dc=in ou: Users objectClass: top objectClass: organizationalUnit structuralObjectClass: organizationalUnit
dn: ou=Passwd,dc=kolkatainfoservices,dc=in ou: Passwd objectClass: top objectClass: organizationalUnit structuralObjectClass: organizationalUnit
dn: ou=Groups,dc=kolkatainfoservices,dc=in ou: Groups objectClass: top objectClass: organizationalUnit structuralObjectClass: organizationalUnit
JOYDEEP wrote, on 13. mar 2007 09:13:
[...]
1> I have executed "saslpasswd2 admin" to create the user admin in the sasldb2
2> "sasldblistusers2" shows as below
admin@linux.kolkatainfoservices.in: userPassword3> now the command *ldapsearch -H ldaps://* when asks the password I gave the admin password stored in sasldb2. and now it is working.
[...]
5> BUT when I added entry for Manager ( as per root dn) and provide the password of manager it is not working. even it is not working for any other uesrs which I have added in sasldb2.
How can I fix the problem ?
PS: here is my ldif as attachment
I don't see any entry for admin in the ldif. 4 things are important:
1: There has to be a section for SASL mapping rules in slapd.conf/cn=config hierarchy as detailed in the admin guide 11.2.6. Something like:
sasl-regexp uid=(.*),cn=digest-md5,cn=auth "ldap:///dc=example,dc=com??sub?uid=$1" What does yours look like?
2: If you want to proxy authorizations using admin (for example), you have to have an admin user in your directory tree (can be anywhere) and you have to give him proxy authorization (saslAuthzTo) as stated in the admin guide 11.3.3 - this will show up in an ldif of his record something like:
dn: cn=admin,dc=example,dc=com changetype: modify add: saslAuthzTo saslAuthzTo: dn.regex:cn=.*,dc=example,dc=com
3; Your ACLs should give the proxy user enough rights to read user passwords and whatever attributes necessary.
4: Using the logs are ok, but the way to test your configuration out is with ldapwhoami (man 1 ldapwhoami). If your setup doesn't work with ldapwhoami it's not right.
Best,
--Tonni
Tony Earnshaw wrote, on 14. mar 2007 03:46:
[...]
Forgot his ldif without the saslAuthTo attribute:
dn: cn=admin,dc=dc=example,dc=com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: top objectClass: posixAccount uid: admin sn: admin cn: admin gidNumber: 10 homeDirectory: /tmp gecos: LDAP Admin user loginShell: /bin/nologin uidNumber: 10 userPassword:: whatever
He doesn't have to have a posixAccount- this is just a example.
--Tonni
Tony Earnshaw wrote:
JOYDEEP wrote, on 13. mar 2007 09:13:
[...]
1> I have executed "saslpasswd2 admin" to create the user admin in the sasldb2
2> "sasldblistusers2" shows as below
admin@linux.kolkatainfoservices.in: userPassword3> now the command *ldapsearch -H ldaps://* when asks the password I gave the admin password stored in sasldb2. and now it is working.
[...]
5> BUT when I added entry for Manager ( as per root dn) and provide the password of manager it is not working. even it is not working for any other uesrs which I have added in sasldb2.
How can I fix the problem ?
PS: here is my ldif as attachment
I don't see any entry for admin in the ldif. 4 things are important:
1: There has to be a section for SASL mapping rules in slapd.conf/cn=config hierarchy as detailed in the admin guide 11.2.6. Something like:
sasl-regexp uid=(.*),cn=digest-md5,cn=auth "ldap:///dc=example,dc=com??sub?uid=$1" What does yours look like?
Thanks a lot Tony. Now it has become clear to me that slapd.conf has some mechanism to talk with sasl. I don't have the sasl-regexp uid=(.*),cn=digest-md5,cn=auth and it is the problem. Thanks for pointing out my mistake. But still I can't understand that how it works with admin in sasldb2 when there is no entry in ldif file and the configuration u suggest is not present in my slapd.conf
2: If you want to proxy authorizations using admin (for example), you have to have an admin user in your directory tree (can be anywhere) and you have to give him proxy authorization (saslAuthzTo) as stated in the admin guide 11.3.3 - this will show up in an ldif of his record something like:
dn: cn=admin,dc=example,dc=com changetype: modify add: saslAuthzTo saslAuthzTo: dn.regex:cn=.*,dc=example,dc=com
3; Your ACLs should give the proxy user enough rights to read user passwords and whatever attributes necessary.
4: Using the logs are ok, but the way to test your configuration out is with ldapwhoami (man 1 ldapwhoami). If your setup doesn't work with ldapwhoami it's not right.
Best,
--Tonni
JOYDEEP wrote, on 14. mar 2007 07:06:
[...]
Thanks a lot Tony. Now it has become clear to me that slapd.conf has some mechanism to talk with sasl. I don't have the sasl-regexp uid=(.*),cn=digest-md5,cn=auth and it is the problem. Thanks for pointing out my mistake. But still I can't understand that how it works with admin in sasldb2 when there is no entry in ldif file and the configuration u suggest is not present in my slapd.conf
Don't know; there's probably a default built into slapd - but it's also probably not what you want, since you would have no control over it.
Consult the admin guide and ask questions one by one about what in it is not clear after reading relevant man pages - probably quite a lot, it's not very clear on how to set up SASL step by step.
Best,
--Tonni
openldap-software@openldap.org
-
JOYDEEP -
Tony Earnshaw