On 12/17/15 18:32 -0600, Timothy Keith wrote:
We are attempting to set up an LDAP server which will answer queries from an application. The database will contain metadata on a set of users in the application. The application will also query the server to authenticate the user’s password, however, this server will not house the password. That resides on another server, which our server will query. We do not have administrative rights to the other server.
The difficulty we are having now is setting up the pass-through authentication for the passwords. Any pointers in how to proceed with this would be greatly appreciated.
On 12/21/15 17:24 -0600, Timothy Keith wrote:
We have limited access to the servers. Same company, different IT organization. Our LDAP requirement must be transparent to those servers. We want to inherit the LDAP directory information from the Unix servers - mostly the user Id and passwords, and add information that is needed by applications that our servers will manage.
On 12/31/15 09:51 -0600, Timothy Keith wrote:
On Wed, Dec 30, 2015 at 7:04 PM, Dan White dwhite@cafedemocracy.org wrote:
On 12/30/15 18:51 -0600, Timothy Keith wrote:
This is tail of the latest saslauthd debug output :
ldap_sasl_interactive_bind: user selected: DIGEST-MD5
res_errno: 7, res_error: <SASL(-4): no mechanism available: >, res_matched:
<> ldap_free_request (origid 1, msgid 1) ldap_int_sasl_bind: DIGEST-MD5 ldap_parse_sasl_bind_result ldap_parse_result ldap_msgfree ldap_err2string
Is DIGEST-MD5 available on your ldap server? Try:
ldapsearch -LLL -x -H ldap://1.2.3.4 -s "base" -b "" supportedSASLMechanisms Which should list the advertised sasl mechanisms.
Verify the digest-md5 mechanism is installed with saslpluginviewer/pluginviewer.
Dan, that ldapsearch returns : dn: supportedSASLMechanisms: PLAIN
The server is only offering the PLAIN mechanism to you. It appears you're using saslauthd's ldap backend, and have explicitly configured 'ldap_mech: digest-md5' in your corresponding config. If that's correct, you could change that to PLAIN instead.
Consider protecting the bind with tls if available.
slapo-pbind may be a simpler alternative (to pass-through sasl authentication), depending on the specifics of your setup.