Re: SASL and mail attribute help

[Hallvard B Furuseth <h.b.furuseth@usit.uio.no>]

Al Pacifico writes:
> I wish to authenticate using SASL DIGEST-MD5 against the mail and
> userPassword attributes.
>
> The examples at OpenLDAP show use of the uid attribute, which is not present
> for all entries in my directory. I'm not sure how to map to the correct
> authentication request DN.

The "username" from SASL is a SASL identity, not an LDAP attribute.
OpenLDAP puts it UID in the bind DN, but you can use sasl-regexp to
change that.

See 'man slapd.conf' - I think this should do it, though I have not
tested:

sasl-regexp UID=([^,]*),cn=your-realm,CN=DIGEST-MD5,CN=auth
           ldap:///dc=example,dc=com??sub?(mail=$1)

Replace the realm, search base DN, scope and filter with whatever is
appropriate.

-- 
Hallvard
Don't anthropomorphize computers. They hate that.