Hi, I am trying to get Pass-Through authentication to work for password verification.
Following the 'Pass-Through authentication' (14.5) in the openldap 2.4 admin guide, I hve configured saslauthd and slapd.conf (sasl) and managed to successfully authenticate with Active Directory (AD) using the 'testsaslauthd' utility.
Setting a user password in my openldap database in the form
dn: uid=user,ou=org,dc=org.com userPassword: {SASL}joe@ad.example.com SASL%7Duser@ad.example.com
where joe@ad.example.com user@ad.example.com is the userPrincipalName defined for this user in AD.
I can't authenticate, when using the ldapsearch command
$ ldapsearch -x -v -D 'uid=joe,ou=people,dc=myorg.com' -W -h ldaphost
Comes up with error (49)
I have enabled --enable-spasswd --with-cyrus-sasl when compiling openldap
Has anybody configured this type of setup successfully?
My question is - how do I configure my openldap server to talk to 'saslauthd' - which openldap's passthrough delegates password authentication to, when the userpassword is in the form
userPassword: {SASL}joe@ad.example.com SASL%7Duser@ad.example.com
Do I need to have some extra configurations in my openldap slapd.conf file? Currently I only have sasl-host and sasl-secprops defined, as:-
sasl-host 127.0.0.1 # (where my openldap server runs as well) sasl-secprops none
Do I need to do any auth-regex for any translation?
This is my openldap entry for user joe
dn: uid=joe,ou=people,dc=myorg.com objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson cn: Joe sn: Bloggs telephoneNumber: 3333 userPassword: {SASL}joe@ad.example.com SASL%7Djoe@ad.example.com physicalDeliveryOfficeName: J2B/1 givenName: joe uid: joe
Below is my /usr/lib/sasl2/slapd.conf file
mech_list: plain pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux
Below is my /etc/saslauthd.conf file
ldap_servers: ldap://ad.example.com:389
ldap_search_base: ou=People,dc=ad,dc=example,dc=com ldap_filter: (userPrincipalName=%u)
ldap_bind_dn: cn=admin,cn=Users,dc=ad,dc=example,dc=com ldap_password: mypassword
Any help will be greatly appreciated.
Many Thanks
krishan