Seau Yeen Su wrote:
1. After using saslpasswd2 to create the username and password in sasl
database, do i need to add the entry into ldap database with slappasswd
command? When i used slapadd command and it prompts for password, does
it authenticate against sasl database or ldap database?
I assume you're talking about SASL bind with password-based mechs.
It depends whether you want in-directory passwords (mainly userPassword
with clear-text password as attribute value) or not.
2. Do i need to issue saslpasswd2 for each and every user that i want
add into ldap database and to be authenticated via ldap?
Only if you don't store the passwords in the directory.
3. In the slapd.conf file, under rootpw, am i supposed to use the
"secret" or the cleartext password that i keyed in using saslpasswd2 or
some encrypted password?
As values for attribute userPassword rootpw can be hashed or clear-text.
If you also want to bind as rootdn with SASL bind with mech CRAM-MD5 or
DIGEST-MD5 then it has to be clear-text. Otherwise it can be hashed
(e.g. generated/hashed with command-line tool slappasswd).
4. What is the difference between sasl-regexp and authz-regexp?
authz-regexp is the recent keyword in slapd.conf for this.
5. Let's say i issued saslpasswd2 -c admin to create admin as the
administrator. Does this mean in the slapd.conf, the rootdn should be
admin or can it be another name, that will be mapped via
sasl-regexp/authz-regexp? (Which does it use anyway between these 2 :
sasl-regexp & authz-regexp?)
SASL bind with digest password mech only knows a plain user-ID. So you
need an appropriate authz-regexp in slapd.conf to map it to a DN of an
> 6. Previously I set up without sasl and it was rather
merely using slappasswd and save the encyrpted pasword into slapd.conf.
If you used a hashed password in rootpw and you did nothing else then I
doubt you could use that with SASL/DIGEST-MD5 bind.
Don't forget to double check the access control rule for userPassword.
Should contain a clause to grant auth access to anyone.
access to attrs=userPassword
by group="cn=Password Admins,ou=Groups,ou=schulung" =wx
by self =wx
by * =x