Many thanks to everyone here. I've got it working now. The first part of the solution was finding out (thanks Dan!) that cyrus-sasl doesn't use prefix_dir/lib/sasl2/slapd.conf when you build from source unless you explicitly set --with-configdir (Aha!).
After temporarily linking /usr/lib/sasl2 to my prefix_dir/lib/sasl2, it still wasn't working but that was because I'd messed with so many different settings in the sasl slapd.conf. Re-reading the openldap docs on pass-thru authentication and going back to this worked: mech_list: plain pwcheck_method: saslauthd saslauthd_path: /var/state/saslauthd/mux sasl-secprops: none
Brent
Dan White wrote:
On 05/08/10 14:00 -0700, Brent Bice wrote:
I created a lib/sasl2/slapd.conf file again and in it specified: pwcheck_method: saslauthd saslauthd_path: /var/state/saslauthd/mux
If testsaslauth works without specifying a '-f' option, then you shouldn't need to specify saslauthd_path.
I didn't think so either. I put it in just in case slapd was trying to figure out where the socket was by reading this file.
Is that /usr/lib/sasl2/slapd.conf?
See if you can find out what --with-configdir option was passed to your cyrus sasl ./configure when it was compiled, which defaults to /usr/lib/sasl2 (regardless of where the libraries are actually installed).
If you were not creating it in the correct location, then libsasl would default to using sasldb auxprop for authentication. You could create a test user:
saslpasswd -c bbice
to see if sasldb is being used.
I don't think testsaslauthd uses libsasl itself, so if none of that works, you may still need to verify your libsasl is installed and linked correctly. sample-server and sample-client might help (create a /usr/lib/sasl2/sample.conf).
You might also try a direct SASL bind against the server to see if that works. Add 'sasl-secprops none' to your slapd.conf, then do:
ldapwhoami -Y PLAIN -U bbice ...
which should also use saslauthd to authenticate, with pwcheck_method: saslauthd.