RE: SASL authentication, user not found

["Howard Chu" <hyc@highlandsun.com>]

> -----Original Message-----
> From: Karl Lattimer [mailto:k.lattimer@nnc-consultancy.co.uk]

> ldapsearch -U testuser@LSiaB -b 'o=lsiab.lan' '(objectclass=*)'
>
> ^ This seems to work nicely, thanks, I still don't understand
> why, but I'm
> getting the hang of it!!!!

That works because that is the entry in your /etc/sasldb2 according to your
sasldblistusers2 output. If you're using secrets in /etc/sasldb2 then you
have to login with the username that is stored in /etc/sasldb2. If your
default realm is configured correctly you can omit the realm.

Your default realm in /etc/sasldb2 is not configured correctly but using the
full "user@realm" format gets by that problem.

> Wh00p ;))
> -----Original Message-----
> From: Howard Chu [mailto:hyc@highlandsun.com]
> Sent: 22 March 2003 21:50
> To: 'Karl Lattimer'; OpenLDAP-software@OpenLDAP.org
> Subject: RE: SASL authentication, user not found
>
> > -----Original Message-----
> > From: owner-openldap-software@OpenLDAP.org
> > [mailto:owner-openldap-software@OpenLDAP.org]On Behalf Of
> Karl Lattimer
>
> > I've tried setting the realm to LSiaB, I'm now using;
> >
> > ldapsearch -U 'dn: uid=testuser,cn=LSiaB,cn=DIGEST-MD5,cn=auth' -b
> > 'o=lsiab.lan' '(objectclass=*)'
>
> This SASL DN format is only used internally in slapd. The
> SASL library won't
> recognize it, and if you're using secrets in /etc/sasldb this
> will not work.
> Clients should never need to specify names in this manner.
>
> Try ldapsearch -U testuser@LSiaB

  -- Howard Chu
  Chief Architect, Symas Corp.       Director, Highland Sun
  http://www.symas.com               http://highlandsun.com/hyc
  Symas: Premier OpenSource Development and Support