Hello,
I try to do the authentication in LDAP via Kerberos. The Kerberos-Database is in LDAP, no problem, I can login to the system as a normal user but when I do a "ldapwhomami" I get the following output: ----------------- u1-verw@ldapserver:~$ ldapwhoami SASL/GSSAPI authentication started SASL username: u1-verw@EXAMPLE.NET SASL SSF: 256 SASL data security layer installed. dn:uid=u1-verw,cn=gssapi,cn=auth ----------------- I would like to get the original DN from the user not the dn:*,cn=gssapi,cn=auth. So I put into my configuration: ----------------- olcAuthzRegexp: {0}uid=(.+),cn=gssapi,cn=auth ldap:///dc=example,dc=net??sub?(uid=$1) ----------------- But still the same. The log-output: ----------------- Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 fd=37 ACCEPT from IP=192.168.56.60:59276 (IP=0.0.0.0:636) Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 fd=37 TLS established tls_ssf=256 ssf=256 Dec 20 14:42:34 ldapserver ldapwhoami[1914]: GSSAPI client step 1 Dec 20 14:42:34 ldapserver ldapwhoami[1914]: GSSAPI client step 1 Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=0 BIND dn="" method=163 Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Dec 20 14:42:34 ldapserver ldapwhoami[1914]: GSSAPI client step 1 Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=1 BIND dn="" method=163 Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Dec 20 14:42:34 ldapserver ldapwhoami[1914]: GSSAPI client step 2 Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=2 BIND dn="" method=163 Dec 20 14:42:34 ldapserver slapd[493]: => access_allowed: auth access to "dc=example,dc=net" "entry" requested Dec 20 14:42:34 ldapserver slapd[493]: => dn: [1] Dec 20 14:42:34 ldapserver slapd[493]: => dn: [2] cn=subschema Dec 20 14:42:34 ldapserver slapd[493]: => dn: [3] dc=example,dc=net Dec 20 14:42:34 ldapserver slapd[493]: => acl_get: [3] matched Dec 20 14:42:34 ldapserver slapd[493]: => acl_get: [3] attr entry Dec 20 14:42:34 ldapserver slapd[493]: => acl_mask: access to entry "dc=example,dc=net", attr "entry" requested Dec 20 14:42:34 ldapserver slapd[493]: => acl_mask: to all values by "", (=0) Dec 20 14:42:34 ldapserver slapd[493]: <= check a_dn_pat: users Dec 20 14:42:34 ldapserver slapd[493]: <= check a_dn_pat: * Dec 20 14:42:34 ldapserver slapd[493]: <= acl_mask: [2] applying none(=0) (stop) Dec 20 14:42:34 ldapserver slapd[493]: <= acl_mask: [2] mask: none(=0) Dec 20 14:42:34 ldapserver slapd[493]: => slap_access_allowed: auth access denied by none(=0) Dec 20 14:42:34 ldapserver slapd[493]: => access_allowed: no more rules Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=2 BIND authcid="u1-verw" authzid="u1-verw" Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=2 BIND dn="uid=u1-verw,cn=gssapi,cn=auth" mech=GSSAPI sasl_ssf=256 ssf=256 Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=2 RESULT tag=97 err=0 text= Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=3 EXT oid=1.3.6.1.4.1.4203.1.11.3 Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=3 WHOAMI Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=3 RESULT oid= err=0 text= Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=4 UNBIND Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 fd=37 closed Dec 20 14:42:34 ldapserver ldapwhoami[1914]: DIGEST-MD5 common mech free ----------------- The output is with log-level "acl". When I add the rule: ----------------- olcAccess: {1}to * by * read -----------------
ldapwhoami is working like I expected it: ----------------- u1-verw@ldapserver:~$ ldapwhoami SASL/GSSAPI authentication started SASL username: u1-verw@EXAMPLE.NET SASL SSF: 256 SASL data security layer installed. dn:cn=u1 verw,ou=users,ou=verwaltung,ou=firma,dc=example,dc=net -----------------
The log is showing: ----------------- Dec 20 14:46:48 ldapserver slapd[493]: conn=1086 fd=37 ACCEPT from IP=192.168.56.60:59280 (IP=0.0.0.0:636) Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 fd=37 TLS established tls_ssf=256 ssf=256 Dec 20 14:46:49 ldapserver ldapwhoami[1941]: GSSAPI client step 1 Dec 20 14:46:49 ldapserver ldapwhoami[1941]: GSSAPI client step 1 Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=0 BIND dn="" method=163 Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=0 RESULT tag=97 err=14 text=SASL(0): successful result: Dec 20 14:46:49 ldapserver ldapwhoami[1941]: GSSAPI client step 1 Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=1 BIND dn="" method=163 Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=1 RESULT tag=97 err=14 text=SASL(0): successful result: Dec 20 14:46:49 ldapserver ldapwhoami[1941]: GSSAPI client step 2 Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=2 BIND dn="" method=163 Dec 20 14:46:49 ldapserver slapd[493]: => access_allowed: auth access to "dc=example,dc=net" "entry" requested Dec 20 14:46:49 ldapserver slapd[493]: => dn: [1] Dec 20 14:46:49 ldapserver slapd[493]: => acl_get: [2] attr entry Dec 20 14:46:49 ldapserver slapd[493]: => acl_mask: access to entry "dc=example,dc=net", attr "entry" requested Dec 20 14:46:49 ldapserver slapd[493]: => acl_mask: to all values by "", (=0) Dec 20 14:46:49 ldapserver slapd[493]: <= check a_dn_pat: * Dec 20 14:46:49 ldapserver slapd[493]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 20 14:46:49 ldapserver slapd[493]: <= acl_mask: [1] mask: read(=rscxd) Dec 20 14:46:49 ldapserver slapd[493]: => slap_access_allowed: auth access granted by read(=rscxd) Dec 20 14:46:49 ldapserver slapd[493]: => access_allowed: auth access granted by read(=rscxd) Dec 20 14:46:49 ldapserver slapd[493]: => access_allowed: auth access to "cn=u1 Verw,ou=users,ou=Verwaltung,ou=firma,dc=example,dc=net" "uid" requested Dec 20 14:46:49 ldapserver slapd[493]: => dn: [1] Dec 20 14:46:49 ldapserver slapd[493]: => acl_get: [2] attr uid Dec 20 14:46:49 ldapserver slapd[493]: => acl_mask: access to entry "cn=u1 Verw,ou=users,ou=Verwaltung,ou=firma,dc=example,dc=net", attr "uid" requested Dec 20 14:46:49 ldapserver slapd[493]: => acl_mask: to value by "", (=0) Dec 20 14:46:49 ldapserver slapd[493]: <= check a_dn_pat: * Dec 20 14:46:49 ldapserver slapd[493]: <= acl_mask: [1] applying read(=rscxd) (stop) Dec 20 14:46:49 ldapserver slapd[493]: <= acl_mask: [1] mask: read(=rscxd) Dec 20 14:46:49 ldapserver slapd[493]: => slap_access_allowed: auth access granted by read(=rscxd) Dec 20 14:46:49 ldapserver slapd[493]: => access_allowed: auth access granted by read(=rscxd) Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=2 BIND authcid="u1-verw" authzid="u1-verw" Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=2 BIND dn="cn=u1 verw,ou=users,ou=verwaltung,ou=firma,dc=example,dc=net" mech=GSSAPI sasl_ssf=256 ssf=256 Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=2 RESULT tag=97 err=0 text= Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=3 EXT oid=1.3.6.1.4.1.4203.1.11.3 Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=3 WHOAMI Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=3 RESULT oid= err=0 text= Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=4 UNBIND Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 fd=37 closed Dec 20 14:46:49 ldapserver ldapwhoami[1941]: DIGEST-MD5 common mech free -----------------
So it must have something to with ACLs. I can't figure out where to set the permission to get everything working without opening my ldap for everyone. I tried a lot: ----------------- by dn.regex=authzid="(.+)" read or by dn.regex=authcid="(.+)" read or by dn.regex=uid=(.+),cn=gssapi,cn=auth read ----------------- Non of the above is working.
Any hint?
Stefan l
On 12/20/19 8:54 PM, Stefan Kania wrote:
I would like to get the original DN from the user not the dn:*,cn=gssapi,cn=auth. So I put into my configuration:
olcAuthzRegexp: {0}uid=(.+),cn=gssapi,cn=auth ldap:///dc=example,dc=net??sub?(uid=$1)
Looks correct to me.
Dec 20 14:42:34 ldapserver slapd[493]: => access_allowed: auth access to "dc=example,dc=net" "entry" requested [..] Dec 20 14:42:34 ldapserver slapd[493]: => slap_access_allowed: auth access denied by none(=0) [..] When I add the rule:
olcAccess: {1}to * by * read
ldapwhoami is working like I expected it:
anonymous needs auth access to the entries and attributes used for authz-regexp mappings.
At minimum:
access to dn.subtree="dc=example,dc=net" attrs=entry,uid by anonymous auth
Access control is complex. YMMV. So don't use exactly these ACLs because they will block other access you need.
Ciao, Michael.
Thank you for your help, now it's working. I should have read the log more closely, that's was the log said :-) Burt sometimes you just need an input from someone else.
Am 23.12.19 um 09:40 schrieb Michael Ströder:
On 12/20/19 8:54 PM, Stefan Kania wrote:
I would like to get the original DN from the user not the dn:*,cn=gssapi,cn=auth. So I put into my configuration:
olcAuthzRegexp: {0}uid=(.+),cn=gssapi,cn=auth ldap:///dc=example,dc=net??sub?(uid=$1)
Looks correct to me.
Dec 20 14:42:34 ldapserver slapd[493]: => access_allowed: auth access to "dc=example,dc=net" "entry" requested [..] Dec 20 14:42:34 ldapserver slapd[493]: => slap_access_allowed: auth access denied by none(=0) [..] When I add the rule:
olcAccess: {1}to * by * read
ldapwhoami is working like I expected it:
anonymous needs auth access to the entries and attributes used for authz-regexp mappings.
At minimum:
access to dn.subtree="dc=example,dc=net" attrs=entry,uid by anonymous auth
Access control is complex. YMMV. So don't use exactly these ACLs because they will block other access you need.
I know ;-) it will be set wisely.
Stefan
Ciao, Michael.
Am Fri, 20 Dec 2019 20:54:13 +0100 schrieb Stefan Kania stefan@kania-online.de:
Hello,
I try to do the authentication in LDAP via Kerberos. The Kerberos-Database is in LDAP, no problem, I can login to the system as a normal user but when I do a "ldapwhomami" I get the following output: ----------------- u1-verw@ldapserver:~$ ldapwhoami SASL/GSSAPI authentication started SASL username: u1-verw@EXAMPLE.NET SASL SSF: 256 SASL data security layer installed. dn:uid=u1-verw,cn=gssapi,cn=auth
I would like to get the original DN from the user not the dn:*,cn=gssapi,cn=auth. So I put into my configuration:
[...]
I face the same problem with OpenIndiana. To my experience it's only GSSAPI, DIGEST-MD5 and CRAM-MD5 work as expected. But I must admit, it is only on Solaris not on Linux.
-Dieter
Dieter Klünter dieter@dkluenter.de writes:
Am Fri, 20 Dec 2019 20:54:13 +0100 schrieb Stefan Kania stefan@kania-online.de:
Hello,
I try to do the authentication in LDAP via Kerberos. The Kerberos-Database is in LDAP, no problem, I can login to the system as a normal user but when I do a "ldapwhomami" I get the following output: ----------------- u1-verw@ldapserver:~$ ldapwhoami SASL/GSSAPI authentication started SASL username: u1-verw@EXAMPLE.NET SASL SSF: 256 SASL data security layer installed. dn:uid=u1-verw,cn=gssapi,cn=auth
I would like to get the original DN from the user not the dn:*,cn=gssapi,cn=auth. So I put into my configuration:> [...]
I face the same problem with OpenIndiana. To my experience it's only GSSAPI, DIGEST-MD5 and CRAM-MD5 work as expected. But I must admit, it is only on Solaris not on Linux.
A few examples of my sides:
KDC: raspberrypi, OS raspian host: pink, OS OpenSUSE Tumbleweed host: indiana OS OpenIndiana
On Indiana: /usr/lib/openldap/bin/amd64/ldapwhoami -Ygssapi -H ldap://pink.example.com
SASL/GSSAPI authentication started SASL username: dieter@EXAMPLE.COM SASL SSF: 56 SASL data security layer installed. dn:cn=dieter kluenter,ou=partner,o=avci,c=de
/usr/lib/openldap/bin/amd64/ldapwhoami -Y gssapi-H ldap://indiana.example.com SASL/GSSAPI authentication started SASL username: dieter@EXAMPLE.COM SASL SSF: 56 SASL data security layer installed. dn:uid=dieter@example,cn=gssapi,cn=auth
On Tumbleweed:
/usr/bin/ldapwhoami -Y gssapi -H ldap://indiana.example.com SASL/GSSAPI authentication started SASL username: dieter@EXAMPLE.COM SASL SSF: 256 SASL data security layer installed. dn:uid=dieter@example.com,cn=gssapi,cn=auth
LDAP-Server is OpenLDAP-2.4.48 on all hosts and OS's
-Dieter
-- Dieter Klünter | Directory Service http://sys4.de 53°37'09,95"N 10°08'02,42"E
--On Monday, December 23, 2019 10:19 PM +0100 Dieter Klünter dieter@dkluenter.de wrote:
/usr/bin/ldapwhoami -Y gssapi -H ldap://indiana.example.com SASL/GSSAPI authentication started SASL username: dieter@EXAMPLE.COM SASL SSF: 256 SASL data security layer installed. dn:uid=dieter@example.com,cn=gssapi,cn=auth
LDAP-Server is OpenLDAP-2.4.48 on all hosts and OS's
Cyrus-sasl version on each?
--Quanah
--
Quanah Gibson-Mount Product Architect Symas Corporation Packaged, certified, and supported LDAP solutions powered by OpenLDAP: http://www.symas.com
Quanah Gibson-Mount quanah@symas.com writes:
--On Monday, December 23, 2019 10:19 PM +0100 Dieter Klünter dieter@dkluenter.de wrote:
/usr/bin/ldapwhoami -Y gssapi -H ldap://indiana.example.com SASL/GSSAPI authentication started SASL username: dieter@EXAMPLE.COM SASL SSF: 256 SASL data security layer installed. dn:uid=dieter@example.com,cn=gssapi,cn=auth
LDAP-Server is OpenLDAP-2.4.48 on all hosts and OS's
Cyrus-sasl version on each?
OpenIndiana provides package security/gss-5.11-2019 which provides GSSAPI v2, security/libsasl and security/kerberos-5. OpenSuSE provides cyrus-sasl-2.1.27
-Dieter
-- Dieter Klünter | Directory Service http://sys4.de 53°37'09,95"N 10°08'02,42"E
dieter@dkluenter.de (Dieter Klünter) writes:
Quanah Gibson-Mount quanah@symas.com writes:
--On Monday, December 23, 2019 10:19 PM +0100 Dieter Klünter dieter@dkluenter.de wrote:
/usr/bin/ldapwhoami -Y gssapi -H ldap://indiana.example.com SASL/GSSAPI authentication started SASL username: dieter@EXAMPLE.COM SASL SSF: 256 SASL data security layer installed. dn:uid=dieter@example.com,cn=gssapi,cn=auth
LDAP-Server is OpenLDAP-2.4.48 on all hosts and OS's
Cyrus-sasl version on each?
OpenIndiana provides package security/gss-5.11-2019 which provides GSSAPI v2, security/libsasl and security/kerberos-5. OpenSuSE provides cyrus-sasl-2.1.27
OpenIndiana built slapd with:
ldd /usr/lib/amd64/slapd
ldlibldap_r-2.4.so.2 => /usr/lib/64/libldap_r-2.4.so.2 liblber-2.4.so.2 => /usr/lib/64/liblber-2.4.so.2 libltdl.so.7 => /usr/lib/64/libltdl.so.7 libuuid.so.1 => /lib/64/libuuid.so.1 libsasl.so.1 => /usr/lib/64/libsasl.so.1 libnsl.so.1 => /lib/64/libnsl.so.1 libsocket.so.1 => /lib/64/libsocket.so.1 libc.so.1 => /lib/64/libc.so.1 libbresolv.so.2 => /lib/64/libresolv.so.2 libssl.so.1.0.0 => /lib/64/libssl.so.1.0.0 libcrypto.so.1.0.0 => /lib/64/libcrypto.so.1.0.0 libdlpi.so.1 => /lib/64/libdlpi.so.1 libpthread.so.1 => /lib/64/libpthread.so.1 libmd.so.1 => /lib/64/libmd.so.1 libmp.so.2 => /lib/64/libmp.so.2 libdl.so.1 => /lib/64/libdl.so.1 libinetutil.so.1 => /lib/64/libinetutil.so.1 libdladm.so.1 => /lib/64/libdladm.so.1 libdevinfo.so.1 => /lib/64/libdevinfo.so.1 libscf.so.1 => /lib/64/libscf.so.1 librcm.so.1 => /lib/64/librcm.so.1 libnvpair.so.1 => /lib/64/libnvpair.so.1 libexacct.so.1 => /usr/lib/64/libexacct.so.1 libkstat.so.1 => /lib/64/libkstat.so.1 libpool.so.1 => /usr/lib/64/libpool.so.1 libsec.so.1 => /lib/64/libsec.so.1 libgen.so.1 => /lib/64/libgen.so.1 libuutil.so.1 => /lib/64/libuutil.so.1 libsmbios.so.1 => /usr/lib/64/libsmbios.so.1 libxml2.so.2 => /usr/lib/64/libxml2.so.2 libavl.so.1 => /lib/64/libavl.so.1 libidmap.so.1 => /usr/lib/64/libidmap.so.1 libz.so.1 => /usr/lib/64/libz.so.1 liblzma.so.5 => /usr/lib/64/liblzma.so.5 libm.so.2 => /lib/64/libm.so.2 libofmt.so.1 => d /usr/lib/amd64/slapd
-Dieter
-- Dieter Klünter | Directory Service http://sys4.de 53°37'09,95"N 10°08'02,42"E
openldap-technical@openldap.org
-
Dieter Klünter -
dieter＠dkluenter.de
-
Michael Ströder -
Quanah Gibson-Mount -
Stefan Kania