On 05/30/17 08:10 +0200, Ulrich Windl wrote:

...

...

...

Clément OUDOT clem.oudot@gmail.com schrieb am 29.05.2017 um 20:43 in

Nachricht CAK_oV4-DYo6d=LgWnu7foGkYQ4n9mjHiDbmo1t9uGyJT5e8EFQ@mail.gmail.com:

...

2017-05-29 19:00 GMT+02:00 Dan White dwhite@cafedemocracy.org:

...

On 05/29/17 23:36 +0900, Alexandre Rosenberg wrote:

...

I am in a environment where we use both OpenLDAP and Active Directory. All Linux servers authenticate against OpenLDAP where we have user group, unix group (...)

Pass-through authentication should work if you're performing simple binds. Chapter 14 of the admin guide has a good example.

You can also find a tutorial here: https://ltb-project.org/documentation/general/sasl_delegation

I have one question: Why is hte AD admin accound needed to authenticate? I see a problem with the AD admin password being stored in cleartext in the saslauthd configuration...

Here's a simpler approach that does not require storing a password:

https://www.openldap.org/lists/openldap-technical/201106/msg00198.html

This was tested against AD 2003. You may need to use ldaps with newer versions.