Problem using PLAIN SASLMechanism

[Steffen Gruner <steffen.gruner@gmx.de>]

Hi,

I have to configure an second LDAP Server to store an big directory. 
This server should use our primary LDAP server to check the logins.

Here My Problem:

   >ldapsearch -Y PLAIN -W -D uid=root,o=yyy,c=com -b "o=yyy,c=com" -s 
base supportedSASLMechanisms -d1 -O maxssf=0
   ldap_create
   Enter LDAP Password:  
   ldap_sasl_interactive_bind_s: user selected: PLAIN
   ldap_int_sasl_bind: PLAIN
   ldap_new_connection 1 1 0
   ldap_int_open_connection
   ldap_connect_to_host: TCP 127.0.0.1:389
   ldap_new_socket: 3
   ldap_prepare_socket: 3
   ldap_connect_to_host: Trying 127.0.0.1:389
   ldap_pvt_connect: fd: 3 tm: -1 async: 0
   ldap_int_sasl_open: host=grunix
   ldap_err2string
   ldap_sasl_interactive_bind_s: Unknown authentication method (-6)


I have read I have to use PLAIN because of saslauthd can't use other 
mechanisms, is that right? The other mechanisms don't work also :-(


Here the result of the sasl test application:

   > testsaslauthd -s ldap -u root -p yyy -f /var/run/saslauthd/mux
   0: OK "Success."


And here my configuration:

/usr/lib/sasl2/slapd.conf:

   mech_list: PLAIN LOGIN GSSAPI DIGEST-MD5 CRAM-MD5 EXTERNAL
   pwcheck_method: saslauthd
   saslauthd_path: /var/run/saslauthd/mux
   log_level: 7

Here my /etc/openldap/slapd.conf

   include         /etc/openldap/schema/core.schema
   include         /etc/openldap/schema/cosine.schema
   include         /etc/openldap/schema/nis.schema
   include         /etc/openldap/schema/inetorgperson.schema

   pidfile         /var/run/openldap/slapd.pid
   argsfile        /var/run/openldap/slapd.args

   security ssf=0
   sasl-host       127.0.0.1
   sasl-realm      YYY.COM
   sasl-secprops   none

   access to dn.base="" by * read
   access to dn.base="cn=Subschema" by * read

   database        bdb
   suffix            o=yyy,c=com
   rootdn          cn=admin,o=yyy,c=com
   rootpw          secret
   directory       /var/lib/openldap-data
   index   objectClass     eq

   access to dn.subtree="o=yyy,c=com"
       by * read


I have entered "{SASL}root" to the  userPassword attribute to forward 
the password to SASL.

versions:
   openldap 2.4.10
   cyrus-sasl 2.1.22

Has anyone an Idea what happens?

regards, Steffen