Hi all,

i setup an openldap server which is used as MIT-Kerebros backend.

User-Principals have - besides the kerberos attributes - appropriate objectclasses (e.g. simplesecurityObject, organizationalRole) to make also a simple authentication with the attribut userpassword possible.

To consolidate both credentials i made a setup of SASL-Pasthrough with backend Kerberos. So i set the value of the userpassword attribut to.

{SASL}<user>@<realm> and made the required configurations for the saslauthd.

With this configuration all kind of authentications will use the kerberos-password.

I made various tests but there seems to be an issue with preauthentication in openldap.

I got the follwoing result:

=>testsaslauthd is always working if the preauth flag is on or off

=>ldapsearch -x is only working with preauth-flag disabled.

=> It makes no difference if MIT Kerberos use its normal backend

Keep in mind: For clear testing condtions saslauthd-caching has to be disabled !

Don't use the -c Option in saslauthd - otherwise it could happen that your ldapsearch -x is working because you had success with a former testsaslauthd-command !

Has someone a similar setup which is working with enabled preauth ?

Or does someone know if this is supported or not ?

I use LDAP 2.4.44 with cyrus-sasl-2.1.23.

Thanks in advance.

Kind regards

Uli

-- 
===================================

Ulrich Tehrani
Am Ulrichshof 19
79189 Bad Krozingen