You are trying to authenticate through the credentials stored in your active directory servers, not the passwords stored in LDAP, correct? If that is the case, then the easiest means to accomplish that are to use SASL for authentication.

Clément OUDOT wrote: > > 2013/11/19 Jason Brandt <jbrandt(a)fsmail.bradley.edu&gt;: >> >> You are trying to authenticate through the credentials stored in your >> active >> directory servers, not the passwords stored in LDAP, correct? If that is >> the case, then the easiest means to accomplish that are to use SASL for >> authentication. Or he could just read up on slapo-pbind.

Thank you. Yes, the credentials are stored in AD. I saw this documentation, http://ltb-project.org/wiki/documentation/general/sasl_delegation Helped me very much, but I think there are some wrong in my saslauth.conf, because when I put the AD server and ldap_filter = (sAMAccountName=%u is Ok Success SASL, " but when I put my localhost like this: ldap_servers: ldaps://127.0.0.1 #or ldap://localhost #ldap_servers: ldaps://1.1.2.1 ldap_version: 3 ldap_auth_method: bind ldap_search_base: cn=users,dc=foobar,dc=br #ldap_filter: (sAMAccountname=%u) #ldap_filter: (userPrincipalName=%u) ldap_filter: uid=%u ldap_bind_dn: cn=vmail,cn=users,dc=foobar,dc=br #or cn=admin,dc=foobar ldap_password: abc@123 ldap_deref: never ldap_restart: yes ldap_scope: sub ldap_use_sasl: no ldap_start_tls: no ldap_timeout: 10 testsaslauthd -u usertst -p password NO "authentication failed" See the log: Nov 20 09:13:23 mail slapd[12776]: conn=1139 fd=18 ACCEPT from IP=127.0.0.1:50194 (IP=0.0.0.0:636) Nov 20 09:13:23 mail slapd[12776]: conn=1139 fd=18 TLS established tls_ssf=256 ssf=256 Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 BIND dn="cn=vmail,cn=users,dc=foobar,dc=br" method=128 Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 BIND dn="cn=vmail,cn=users,dc=foobar,dc=br" mech=SIMPLE ssf=0 Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 RESULT tag=97 err=0 text= Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SRCH base="cn=users,dc=foobar,dc=br" scope=2 deref=0 filter="(uid=usertst)" Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SRCH attr=dn Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= What can I do to fix this?

I can get you my SASL config from my test environment when I get to the office. One thing to keep in mind, is that you MUST do an authenticated bind to AD, you cannot do anonymous bind, so you have to have a service account setup to allow SASL to authenticate to AD. It can be the most basic user account, just has to be able to log into AD. On Wed, Nov 20, 2013 at 6:26 AM, Clément OUDOT <clem.oudot(a)gmail.com&gt;wrote: > 2013/11/20 <wrm(a)cdtn.br&gt;: > > Thank you. > > > > Yes, the credentials are stored in AD. > > > > I saw this documentation, > > http://ltb-project.org/wiki/documentation/general/sasl_delegation > > > > Helped me very much, but I think there are some wrong in my > saslauth.conf, > > because when I put the AD server and ldap_filter = (sAMAccountName=%u is > > Ok Success SASL, " but when I put my localhost like this: > > > > ldap_servers: ldaps://127.0.0.1 #or ldap://localhost > > #ldap_servers: ldaps://1.1.2.1 > > ldap_version: 3 > > ldap_auth_method: bind > > ldap_search_base: cn=users,dc=foobar,dc=br > > #ldap_filter: (sAMAccountname=%u) > > #ldap_filter: (userPrincipalName=%u) > > ldap_filter: uid=%u > > ldap_bind_dn: cn=vmail,cn=users,dc=foobar,dc=br #or > cn=admin,dc=foobar > > ldap_password: abc@123 > > ldap_deref: never > > ldap_restart: yes > > ldap_scope: sub > > ldap_use_sasl: no > > ldap_start_tls: no > > ldap_timeout: 10 > > > > > > testsaslauthd -u usertst -p password > > > > NO "authentication failed" > > > > See the log: > > > > Nov 20 09:13:23 mail slapd[12776]: conn=1139 fd=18 ACCEPT from > > IP=127.0.0.1:50194 (IP=0.0.0.0:636) > > Nov 20 09:13:23 mail slapd[12776]: conn=1139 fd=18 TLS established > > tls_ssf=256 ssf=256 > > Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 BIND > > dn="cn=vmail,cn=users,dc=foobar,dc=br" method=128 > > Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 BIND > > dn="cn=vmail,cn=users,dc=foobar,dc=br" mech=SIMPLE ssf=0 > > Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 RESULT tag=97 err=0 > text= > > Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SRCH > > base="cn=users,dc=foobar,dc=br" scope=2 deref=0 filter="(uid=usertst)" > > Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SRCH attr=dn > > Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SEARCH RESULT tag=101 > > err=0 nentries=0 text= > > > > What can I do to fix this? > > > > The log says that the entry is not found (nentries=0) either because > it does not exist, either because you can't read it (ACL). > > But what are you using localhost behind your SASL pass trough? Seems > like you are doing a loop on your LDAP server. > > > Clément. > -- Jason K. Brandt Systems Administrator Bradley University (309) 677-2958

Em 20/11/2013 10:26, Clément OUDOT escreveu: > 2013/11/20 <wrm(a)cdtn.br&gt;: > > Thank you. >> >> Yes, the credentials are stored in AD. >> >> I saw this documentation, >> http://ltb-project.org/wiki/documentation/general/sasl_delegation >> >> Helped me very much, but I think there are some wrong in my >> saslauth.conf, >> because when I put the AD server and ldap_filter = (sAMAccountName=%u is >> Ok Success SASL, " but when I put my localhost like this: >> >> ldap_servers: ldaps://127.0.0.1 #or ldap://localhost >> #ldap_servers: ldaps://1.1.2.1 >> ldap_version: 3 >> ldap_auth_method: bind >> ldap_search_base: cn=users,dc=foobar,dc=br >> #ldap_filter: (sAMAccountname=%u) >> #ldap_filter: (userPrincipalName=%u) >> ldap_filter: uid=%u >> ldap_bind_dn: cn=vmail,cn=users,dc=foobar,dc=br #or >> cn=admin,dc=foobar >> ldap_password: abc@123 >> ldap_deref: never >> ldap_restart: yes >> ldap_scope: sub >> ldap_use_sasl: no >> ldap_start_tls: no >> ldap_timeout: 10 >> >> >> testsaslauthd -u usertst -p password >> >> NO "authentication failed" >> >> See the log: >> >> Nov 20 09:13:23 mail slapd[12776]: conn=1139 fd=18 ACCEPT from >> IP=127.0.0.1:50194 (IP=0.0.0.0:636) >> Nov 20 09:13:23 mail slapd[12776]: conn=1139 fd=18 TLS established >> tls_ssf=256 ssf=256 >> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 BIND >> dn="cn=vmail,cn=users,dc=foobar,dc=br" method=128 >> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 BIND >> dn="cn=vmail,cn=users,dc=foobar,dc=br" mech=SIMPLE ssf=0 >> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=0 RESULT tag=97 err=0 >> text= >> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SRCH >> base="cn=users,dc=foobar,dc=br" scope=2 deref=0 filter="(uid=usertst)" >> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SRCH attr=dn >> Nov 20 09:13:23 mail slapd[12776]: conn=1139 op=1 SEARCH RESULT tag=101 >> err=0 nentries=0 text= >> >> What can I do to fix this? >> >> The log says that the entry is not found (nentries=0) either because > it does not exist, either because you can't read it (ACL). > > But what are you using localhost behind your SASL pass trough? Seems > like you are doing a loop on your LDAP server. > > > Clément. > > > That is a problem, because don´t found the base but when I´m using ldapsearch my search is acepted, very strange. how this example: ldapsearch -x -H ldaps://localhost -b dc=foobar,dc=com -D cn=usertst,cn=users,dc=foobar,dc=com -w password I see all objects in database, when I do this command. If you had another idea please tell me, I just was seeing that link in the ltb-project.org. where tell me to use in localhost SASL. -- Att. Willy R. M CDTN/System Software 31-3069-3303

On Wed, Nov 20, 2013 at 02:55:43PM -0200, Willy Ramos wrote: > Subject: Re: Openldap for proxy AD Have you tried following the examples in the Admin Guide? http://www.openldap.org/doc/admin24/security.html#Pass-Through%20authenti... There is a detailed setup and diagnosic guide there which should help you to isolate the problem. Andrew

Hi, since it is working for a lot of people (including some of our customers) it seems that you are doing something wrong. What about the contents of your entries: Are you sure that you have the attribute userPassword with the value {SASL}<username>@<AD-realm> set in all entries that are to bind via AD? Cheers, Peter Am 22.11.2013 15:05, schrieb Willy Ramos: > Em 22/11/2013 09:21, Andrew Findlay escreveu: >> On Wed, Nov 20, 2013 at 02:55:43PM -0200, Willy Ramos wrote: >> >>> Subject: Re: Openldap for proxy AD >> Have you tried following the examples in the Admin Guide? >> >> http://www.openldap.org/doc/admin24/security.html#Pass-Through%20authenti... >> >> >> There is a detailed setup and diagnosic guide there which should help >> you >> to isolate the problem. >> >> Andrew > Thanks Andrew, > > I was testing based in this Admin Guide. > > When I Check that the user can bind to AD: > > ldapsearch -x -Hldap://dc1.example.com/ \ > -D cn=user,cn=Users,DC=ad,DC=example,DC=com \ > -w userpassword \ > -b cn=user,cn=Users,DC=ad,DC=example,DC=com \ > Or with > -s base \ > "(objectclass=*)" > Or > > testsaslauthd -u user -p userpassword > > It´s works. > > I was reading about and Seems don´t find the schemas of objectclass or > userPassword attribute; > > But I could not resolve yet. > > See the logs > > > Nov 22 11:57:30 mail slapd[18370]: conn=1192 fd=11 ACCEPT from > IP=127.0.0.1:51698 (IP=0.0.0.0:636) > Nov 22 11:57:30 mail slapd[18370]: conn=1192 fd=11 TLS established > tls_ssf=256 ssf=256 > Nov 22 11:57:30 mail slapd[18370]: conn=1192 op=0 EXT > oid=1.3.6.1.4.1.1466.20037 > Nov 22 11:57:30 mail slapd[18370]: conn=1192 op=0 STARTTLS > Nov 22 11:57:30 mail slapd[18370]: conn=1192 op=0 RESULT oid= err=1 > text=TLS already started > Nov 22 11:57:30 mail slapd[18370]: conn=1192 op=1 UNBIND > Nov 22 11:57:30 mail slapd[18370]: conn=1192 fd=11 closed > > Thanks. >