Danke Dieter und Dirk!   :-)

Actually, late yesterday afternoon, I finally discovered what the problem was.   I was using "-ZZ -Y EXTERNAL" and I did verify all the Cyrus packages.   You probably wouldn't believe how far "down the rabbit hole" I went on some of that stuff.   It's very interesting what can be done with Cyrus for example.   LOL

My problem was that I didn't RTFM!   Well, not *enough* of the manual.   I neglected the ldap.conf man page.   I didn't realize that variables like TLS_CERT and TLS_KEY cannot be specified in the global ldap.conf.   So the user-side certs were never being offered up.   Once I created a ~/.ldaprc with the proper variables and valid cert, presto it worked.

The thing that was throwing me off is that, unless you bind with a cert, the DSE does not give the EXTERNAL value of the supportedSASLMechanisms attribute.    It seems as though I should be able to do a simple bind (if otherwise allowed, which it is on my DIT) and see all the mechanisms available.    Turns out that's not the case.

Also, the local4.debug (from the server) and the "-d -1" (from the command line utilities) are not very helpful.   Things like "End of file" or "Is a directory", etc, etc, are not the actual problem but are the only related things reported.

Anyway, with the help of a coworker, I did finally RTFM and figured that out.   So I just wanted to thank you guys for your assistance and report back that I'm good with this issue now.

Thanks,
Frank


On Wed, Sep 2, 2015 at 5:04 AM, Dirk Kastens <dirk.kastens@uni-osnabrueck.de> wrote:
Hi Frank,

if you want SASL to work, you need to have the cyrus-sasl libraries installed. And slapd has to be compiled with sasl support:

# rpm -qa | grep sasl
cyrus-sasl-lib-2.1.23-8.el6.x86_64
cyrus-sasl-2.1.23-8.el6.x86_64
cyrus-sasl-plain-2.1.23-8.el6.x86_64

# ldd /usr/sbin/slapd
...
  libsasl2.so.2 => /usr/lib64/libsasl2.so.2 (0x00007f8152dbb000)
...

I'm trying to configure OpenLDAP 2.4.23 (running on RHEL6.5) to use
client-side certificates via the SASL/EXTERNAL mechanism.   I have
successfully configured server-side certs with TLS and was wanting to
expand my configuration on the client-side.

If set the TLSClientVerify to "allow" or "try" and attempt to use "-Y
EXTERNAL", I get the following message:

SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
               additional info: SASL (-4): no mechaism available:


If I do a search on the DSE, I get the following available methods:

dn:
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: LOGIN
supportedSASLMechanisms: CRAM-MD5
supportedSASLMechanisms: DIGEST-MD5
supportedSASLMechanisms: PLAIN


I know that other people are using this but nobody (here at work) knows
why my particular configuration is getting this error.   Can anyone help
me figure this out?

Regards,

Dirk Kastens




--
Frank