11:54 a.m.
Hello,
I try to do the authentication in LDAP via Kerberos. The
Kerberos-Database is in LDAP, no problem, I can login to the system as a
normal user but when I do a "ldapwhomami" I get the following output:
-----------------
u1-verw@ldapserver:~$ ldapwhoami
SASL/GSSAPI authentication started
SASL username: u1-verw(a)EXAMPLE.NET
SASL SSF: 256
SASL data security layer installed.
dn:uid=u1-verw,cn=gssapi,cn=auth
-----------------
I would like to get the original DN from the user not the
dn:*,cn=gssapi,cn=auth. So I put into my configuration:
-----------------
olcAuthzRegexp: {0}uid=(.+),cn=gssapi,cn=auth
ldap:///dc=example,dc=net??sub?(uid=$1)
-----------------
But still the same. The log-output:
-----------------
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 fd=37 ACCEPT from
IP=192.168.56.60:59276 (IP=0.0.0.0:636)
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 fd=37 TLS established
tls_ssf=256 ssf=256
Dec 20 14:42:34 ldapserver ldapwhoami[1914]: GSSAPI client step 1
Dec 20 14:42:34 ldapserver ldapwhoami[1914]: GSSAPI client step 1
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=0 BIND dn="" method=163
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=0 RESULT tag=97
err=14 text=SASL(0): successful result:
Dec 20 14:42:34 ldapserver ldapwhoami[1914]: GSSAPI client step 1
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=1 BIND dn="" method=163
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=1 RESULT tag=97
err=14 text=SASL(0): successful result:
Dec 20 14:42:34 ldapserver ldapwhoami[1914]: GSSAPI client step 2
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=2 BIND dn="" method=163
Dec 20 14:42:34 ldapserver slapd[493]: => access_allowed: auth access to
"dc=example,dc=net" "entry" requested
Dec 20 14:42:34 ldapserver slapd[493]: => dn: [1]
Dec 20 14:42:34 ldapserver slapd[493]: => dn: [2] cn=subschema
Dec 20 14:42:34 ldapserver slapd[493]: => dn: [3] dc=example,dc=net
Dec 20 14:42:34 ldapserver slapd[493]: => acl_get: [3] matched
Dec 20 14:42:34 ldapserver slapd[493]: => acl_get: [3] attr entry
Dec 20 14:42:34 ldapserver slapd[493]: => acl_mask: access to entry
"dc=example,dc=net", attr "entry" requested
Dec 20 14:42:34 ldapserver slapd[493]: => acl_mask: to all values by "",
(=0)
Dec 20 14:42:34 ldapserver slapd[493]: <= check a_dn_pat: users
Dec 20 14:42:34 ldapserver slapd[493]: <= check a_dn_pat: *
Dec 20 14:42:34 ldapserver slapd[493]: <= acl_mask: [2] applying
none(=0) (stop)
Dec 20 14:42:34 ldapserver slapd[493]: <= acl_mask: [2] mask: none(=0)
Dec 20 14:42:34 ldapserver slapd[493]: => slap_access_allowed: auth
access denied by none(=0)
Dec 20 14:42:34 ldapserver slapd[493]: => access_allowed: no more rules
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=2 BIND
authcid="u1-verw" authzid="u1-verw"
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=2 BIND
dn="uid=u1-verw,cn=gssapi,cn=auth" mech=GSSAPI sasl_ssf=256 ssf=256
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=2 RESULT tag=97
err=0 text=
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=3 EXT
oid=1.3.6.1.4.1.4203.1.11.3
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=3 WHOAMI
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=3 RESULT oid= err=0
text=
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 op=4 UNBIND
Dec 20 14:42:34 ldapserver slapd[493]: conn=1082 fd=37 closed
Dec 20 14:42:34 ldapserver ldapwhoami[1914]: DIGEST-MD5 common mech free
-----------------
The output is with log-level "acl".
When I add the rule:
-----------------
olcAccess: {1}to * by * read
-----------------
ldapwhoami is working like I expected it:
-----------------
u1-verw@ldapserver:~$ ldapwhoami
SASL/GSSAPI authentication started
SASL username: u1-verw(a)EXAMPLE.NET
SASL SSF: 256
SASL data security layer installed.
dn:cn=u1 verw,ou=users,ou=verwaltung,ou=firma,dc=example,dc=net
-----------------
The log is showing:
-----------------
Dec 20 14:46:48 ldapserver slapd[493]: conn=1086 fd=37 ACCEPT from
IP=192.168.56.60:59280 (IP=0.0.0.0:636)
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 fd=37 TLS established
tls_ssf=256 ssf=256
Dec 20 14:46:49 ldapserver ldapwhoami[1941]: GSSAPI client step 1
Dec 20 14:46:49 ldapserver ldapwhoami[1941]: GSSAPI client step 1
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=0 BIND dn="" method=163
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=0 RESULT tag=97
err=14 text=SASL(0): successful result:
Dec 20 14:46:49 ldapserver ldapwhoami[1941]: GSSAPI client step 1
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=1 BIND dn="" method=163
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=1 RESULT tag=97
err=14 text=SASL(0): successful result:
Dec 20 14:46:49 ldapserver ldapwhoami[1941]: GSSAPI client step 2
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=2 BIND dn="" method=163
Dec 20 14:46:49 ldapserver slapd[493]: => access_allowed: auth access to
"dc=example,dc=net" "entry" requested
Dec 20 14:46:49 ldapserver slapd[493]: => dn: [1]
Dec 20 14:46:49 ldapserver slapd[493]: => acl_get: [2] attr entry
Dec 20 14:46:49 ldapserver slapd[493]: => acl_mask: access to entry
"dc=example,dc=net", attr "entry" requested
Dec 20 14:46:49 ldapserver slapd[493]: => acl_mask: to all values by "",
(=0)
Dec 20 14:46:49 ldapserver slapd[493]: <= check a_dn_pat: *
Dec 20 14:46:49 ldapserver slapd[493]: <= acl_mask: [1] applying
read(=rscxd) (stop)
Dec 20 14:46:49 ldapserver slapd[493]: <= acl_mask: [1] mask: read(=rscxd)
Dec 20 14:46:49 ldapserver slapd[493]: => slap_access_allowed: auth
access granted by read(=rscxd)
Dec 20 14:46:49 ldapserver slapd[493]: => access_allowed: auth access
granted by read(=rscxd)
Dec 20 14:46:49 ldapserver slapd[493]: => access_allowed: auth access to
"cn=u1 Verw,ou=users,ou=Verwaltung,ou=firma,dc=example,dc=net" "uid"
requested
Dec 20 14:46:49 ldapserver slapd[493]: => dn: [1]
Dec 20 14:46:49 ldapserver slapd[493]: => acl_get: [2] attr uid
Dec 20 14:46:49 ldapserver slapd[493]: => acl_mask: access to entry
"cn=u1 Verw,ou=users,ou=Verwaltung,ou=firma,dc=example,dc=net", attr
"uid" requested
Dec 20 14:46:49 ldapserver slapd[493]: => acl_mask: to value by "", (=0)
Dec 20 14:46:49 ldapserver slapd[493]: <= check a_dn_pat: *
Dec 20 14:46:49 ldapserver slapd[493]: <= acl_mask: [1] applying
read(=rscxd) (stop)
Dec 20 14:46:49 ldapserver slapd[493]: <= acl_mask: [1] mask: read(=rscxd)
Dec 20 14:46:49 ldapserver slapd[493]: => slap_access_allowed: auth
access granted by read(=rscxd)
Dec 20 14:46:49 ldapserver slapd[493]: => access_allowed: auth access
granted by read(=rscxd)
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=2 BIND
authcid="u1-verw" authzid="u1-verw"
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=2 BIND dn="cn=u1
verw,ou=users,ou=verwaltung,ou=firma,dc=example,dc=net" mech=GSSAPI
sasl_ssf=256 ssf=256
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=2 RESULT tag=97
err=0 text=
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=3 EXT
oid=1.3.6.1.4.1.4203.1.11.3
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=3 WHOAMI
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=3 RESULT oid= err=0
text=
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 op=4 UNBIND
Dec 20 14:46:49 ldapserver slapd[493]: conn=1086 fd=37 closed
Dec 20 14:46:49 ldapserver ldapwhoami[1941]: DIGEST-MD5 common mech free
-----------------
So it must have something to with ACLs. I can't figure out where to set
the permission to get everything working without opening my ldap for
everyone. I tried a lot:
-----------------
by dn.regex=authzid="(.+)" read
or
by dn.regex=authcid="(.+)" read
or
by dn.regex=uid=(.+),cn=gssapi,cn=auth read
-----------------
Non of the above is working.
Any hint?
Stefan
l
12:40 a.m.
On 12/20/19 8:54 PM, Stefan Kania wrote:
I would like to get the original DN from the user not the
dn:*,cn=gssapi,cn=auth. So I put into my configuration:
-----------------
olcAuthzRegexp: {0}uid=(.+),cn=gssapi,cn=auth
ldap:///dc=example,dc=net??sub?(uid=$1)
-----------------
Looks correct to me.
Dec 20 14:42:34 ldapserver slapd[493]: => access_allowed: auth
access to
"dc=example,dc=net" "entry" requested
[..]
Dec 20 14:42:34 ldapserver slapd[493]: => slap_access_allowed: auth
access denied by none(=0)
[..]
When I add the rule:
-----------------
olcAccess: {1}to * by * read
-----------------
ldapwhoami is working like I expected it:
anonymous needs auth access to the entries and attributes used for
authz-regexp mappings.
At minimum:
access to
dn.subtree="dc=example,dc=net"
attrs=entry,uid
by anonymous auth
Access control is complex. YMMV. So don't use exactly these ACLs because
they will block other access you need.
Ciao, Michael.
9:30 a.m.
Thank you for your help, now it's working. I should have read the log
more closely, that's was the log said :-) Burt sometimes you just need
an input from someone else.
Am 23.12.19 um 09:40 schrieb Michael Ströder:
On 12/20/19 8:54 PM, Stefan Kania wrote:
> I would like to get the original DN from the user not the
> dn:*,cn=gssapi,cn=auth. So I put into my configuration:
> -----------------
> olcAuthzRegexp: {0}uid=(.+),cn=gssapi,cn=auth
> ldap:///dc=example,dc=net??sub?(uid=$1)
> -----------------
Looks correct to me.
> Dec 20 14:42:34 ldapserver slapd[493]: => access_allowed: auth access to
> "dc=example,dc=net" "entry" requested
> [..]
> Dec 20 14:42:34 ldapserver slapd[493]: => slap_access_allowed: auth
> access denied by none(=0)
> [..]
> When I add the rule:
> -----------------
> olcAccess: {1}to * by * read
> -----------------
> ldapwhoami is working like I expected it:
anonymous needs auth access to the entries and attributes used for
authz-regexp mappings.
At minimum:
access to
dn.subtree="dc=example,dc=net"
attrs=entry,uid
by anonymous auth
Access control is complex. YMMV. So don't use exactly these ACLs because
they will block other access you need.
I know ;-) it will be set wisely.
Stefan
Ciao, Michael.
--
12:30 p.m.
Am Fri, 20 Dec 2019 20:54:13 +0100
schrieb Stefan Kania <stefan(a)kania-online.de>:
Hello,
I try to do the authentication in LDAP via Kerberos. The
Kerberos-Database is in LDAP, no problem, I can login to the system
as a normal user but when I do a "ldapwhomami" I get the following
output: -----------------
u1-verw@ldapserver:~$ ldapwhoami
SASL/GSSAPI authentication started
SASL username: u1-verw(a)EXAMPLE.NET
SASL SSF: 256
SASL data security layer installed.
dn:uid=u1-verw,cn=gssapi,cn=auth
-----------------
I would like to get the original DN from the user not the
dn:*,cn=gssapi,cn=auth. So I put into my configuration:
[...]
I face the same problem with OpenIndiana. To my experience it's only
GSSAPI, DIGEST-MD5 and CRAM-MD5 work as expected. But I must admit, it
is only on Solaris not on Linux.
-Dieter
--
Dieter Klünter | Systemberatung
http://sys4.de
GPG Key ID: E9ED159B
53°37'09,95"N
10°08'02,42"E
1:19 p.m.
Dieter Klünter <dieter(a)dkluenter.de> writes:
Am Fri, 20 Dec 2019 20:54:13 +0100
schrieb Stefan Kania <stefan(a)kania-online.de>:
> Hello,
>
> I try to do the authentication in LDAP via Kerberos. The
> Kerberos-Database is in LDAP, no problem, I can login to the system
> as a normal user but when I do a "ldapwhomami" I get the following
> output: -----------------
> u1-verw@ldapserver:~$ ldapwhoami
> SASL/GSSAPI authentication started
> SASL username: u1-verw(a)EXAMPLE.NET
> SASL SSF: 256
> SASL data security layer installed.
> dn:uid=u1-verw,cn=gssapi,cn=auth
> -----------------
> I would like to get the original DN from the user not the
> dn:*,cn=gssapi,cn=auth. So I put into my configuration:> [...]
I face the same problem with OpenIndiana. To my experience it's only
GSSAPI, DIGEST-MD5 and CRAM-MD5 work as expected. But I must admit, it
is only on Solaris not on Linux.
A few examples of my sides:
KDC: raspberrypi, OS raspian
host: pink, OS OpenSUSE Tumbleweed
host: indiana OS OpenIndiana
On Indiana:
/usr/lib/openldap/bin/amd64/ldapwhoami -Ygssapi -H
ldap://pink.example.com
SASL/GSSAPI authentication started
SASL username: dieter(a)EXAMPLE.COM
SASL SSF: 56
SASL data security layer installed.
dn:cn=dieter kluenter,ou=partner,o=avci,c=de
/usr/lib/openldap/bin/amd64/ldapwhoami -Y gssapi-H ldap://indiana.example.com
SASL/GSSAPI authentication started
SASL username: dieter(a)EXAMPLE.COM
SASL SSF: 56
SASL data security layer installed.
dn:uid=dieter@example,cn=gssapi,cn=auth
On Tumbleweed:
/usr/bin/ldapwhoami -Y gssapi -H ldap://indiana.example.com
SASL/GSSAPI authentication started
SASL username: dieter(a)EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
dn:uid=dieter@example.com,cn=gssapi,cn=auth
LDAP-Server is OpenLDAP-2.4.48 on all hosts and OS's
-Dieter
--
Dieter Klünter | Directory Service
http://sys4.de
53°37'09,95"N
10°08'02,42"E
1:29 p.m.
--On Monday, December 23, 2019 10:19 PM +0100 Dieter Klünter
<dieter(a)dkluenter.de> wrote:
/usr/bin/ldapwhoami -Y gssapi -H ldap://indiana.example.com
SASL/GSSAPI authentication started
SASL username: dieter(a)EXAMPLE.COM
SASL SSF: 256
SASL data security layer installed.
dn:uid=dieter@example.com,cn=gssapi,cn=auth
LDAP-Server is OpenLDAP-2.4.48 on all hosts and OS's
Cyrus-sasl version on each?
--Quanah
--
Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>
2:04 a.m.
Quanah Gibson-Mount <quanah(a)symas.com> writes:
--On Monday, December 23, 2019 10:19 PM +0100 Dieter Klünter
<dieter(a)dkluenter.de> wrote:
> /usr/bin/ldapwhoami -Y gssapi -H ldap://indiana.example.com
> SASL/GSSAPI authentication started
> SASL username: dieter(a)EXAMPLE.COM
> SASL SSF: 256
> SASL data security layer installed.
> dn:uid=dieter@example.com,cn=gssapi,cn=auth
>
>
> LDAP-Server is OpenLDAP-2.4.48 on all hosts and OS's
Cyrus-sasl version on each?
OpenIndiana provides package security/gss-5.11-2019 which provides GSSAPI v2,
security/libsasl and security/kerberos-5.
OpenSuSE provides cyrus-sasl-2.1.27
-Dieter
--
Dieter Klünter | Directory Service
http://sys4.de
53°37'09,95"N
10°08'02,42"E
2:26 a.m.
dieter(a)dkluenter.de (Dieter Klünter) writes:
Quanah Gibson-Mount <quanah(a)symas.com> writes:
> --On Monday, December 23, 2019 10:19 PM +0100 Dieter Klünter
> <dieter(a)dkluenter.de> wrote:
>
>> /usr/bin/ldapwhoami -Y gssapi -H ldap://indiana.example.com
>> SASL/GSSAPI authentication started
>> SASL username: dieter(a)EXAMPLE.COM
>> SASL SSF: 256
>> SASL data security layer installed.
>> dn:uid=dieter@example.com,cn=gssapi,cn=auth
>>
>>
>> LDAP-Server is OpenLDAP-2.4.48 on all hosts and OS's
>
> Cyrus-sasl version on each?
OpenIndiana provides package security/gss-5.11-2019 which provides GSSAPI v2,
security/libsasl and security/kerberos-5.
OpenSuSE provides cyrus-sasl-2.1.27
OpenIndiana built slapd with:
ldd /usr/lib/amd64/slapd
ldlibldap_r-2.4.so.2 => /usr/lib/64/libldap_r-2.4.so.2
liblber-2.4.so.2 => /usr/lib/64/liblber-2.4.so.2
libltdl.so.7 => /usr/lib/64/libltdl.so.7
libuuid.so.1 => /lib/64/libuuid.so.1
libsasl.so.1 => /usr/lib/64/libsasl.so.1
libnsl.so.1 => /lib/64/libnsl.so.1
libsocket.so.1 => /lib/64/libsocket.so.1
libc.so.1 => /lib/64/libc.so.1
libbresolv.so.2 => /lib/64/libresolv.so.2
libssl.so.1.0.0 => /lib/64/libssl.so.1.0.0
libcrypto.so.1.0.0 => /lib/64/libcrypto.so.1.0.0
libdlpi.so.1 => /lib/64/libdlpi.so.1
libpthread.so.1 => /lib/64/libpthread.so.1
libmd.so.1 => /lib/64/libmd.so.1
libmp.so.2 => /lib/64/libmp.so.2
libdl.so.1 => /lib/64/libdl.so.1
libinetutil.so.1 => /lib/64/libinetutil.so.1
libdladm.so.1 => /lib/64/libdladm.so.1
libdevinfo.so.1 => /lib/64/libdevinfo.so.1
libscf.so.1 => /lib/64/libscf.so.1
librcm.so.1 => /lib/64/librcm.so.1
libnvpair.so.1 => /lib/64/libnvpair.so.1
libexacct.so.1 => /usr/lib/64/libexacct.so.1
libkstat.so.1 => /lib/64/libkstat.so.1
libpool.so.1 => /usr/lib/64/libpool.so.1
libsec.so.1 => /lib/64/libsec.so.1
libgen.so.1 => /lib/64/libgen.so.1
libuutil.so.1 => /lib/64/libuutil.so.1
libsmbios.so.1 => /usr/lib/64/libsmbios.so.1
libxml2.so.2 => /usr/lib/64/libxml2.so.2
libavl.so.1 => /lib/64/libavl.so.1
libidmap.so.1 => /usr/lib/64/libidmap.so.1
libz.so.1 => /usr/lib/64/libz.so.1
liblzma.so.5 => /usr/lib/64/liblzma.so.5
libm.so.2 => /lib/64/libm.so.2
libofmt.so.1 => d /usr/lib/amd64/slapd
-Dieter
--
Dieter Klünter | Directory Service
http://sys4.de
53°37'09,95"N
10°08'02,42"E
1440
days inactive
1444
days old
openldap-technical@openldap.org
7 comments
5 participants
participants (5)
-
Dieter Klünter -
dieter＠dkluenter.de
-
Michael Ströder -
Quanah Gibson-Mount -
Stefan Kania