On 22/07/10 18:10 +0530, Shankar Anand R wrote:

Hi,

The problem explained below must be fairly straightforward or even look
silly for folks on this mailing list. Sorry for the trouble but I hope one
of you might be willing to help a newbie.

I am implementing an simple application that finds out a user's attributes
using OpenLDAP.

This a snippet of my code.
...
BerValue cred;
cred.bv_len = 10;
cred.bv_val = strdup("mypassword");
ldap_sasl_bind_s(ld, "myuser", LDAP_SASL_SIMPLE /*NULL*/, &cred, NULL, NULL,
NULL);

This succeeds and I am able to proceed with my ldap_search_st() call.

But since I don't want to send "mypassword" as plain text over the wire I
opted for "DIGEST-MD5"

...
BerValue cred;
cred.bv_len = 10;
cred.bv_val = strdup("mypassword");
ldap_sasl_bind_s(ld, "myuser", "DIGEST-MD5", &cred, NULL, NULL, NULL);

This fails with the error 49
ldap_sasl_bind_s: Invalid credentials (49)
      additional info: 80090326: LdapErr: DSID-0C0904D1, comment:
AcceptSecurityContext error, data 57, v1772


Note: I am using Active Directory. And I believe that my cyrus-sasl
installation is good.


I searched a lot but couldn't find the proper documentation for this. Do I
have to fill up cred.bv_val differently while using DIGEST-MD5? Is there an
OpenLDAP API to do that?
Can someone explain or point me to the right documentation?

See the man page for ldap_sasl_interactive_bind_s(), in which you provide a
callback function for providing the sasl realm, authc identity, password,
and authz identity.

Also see doc/programming.html in the cyrus sasl source for discussion of
interactions, and plugins/ldapdb.c for a working example.