[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: saslmech=EXTERNAL



--On July 14, 2009 8:14:10 PM -0700 Greek Ordono <grexk@yahoo.com> wrote:


I tried that following configuration:

chain-idassert-bind bindmethod=sasl
        saslmech=EXTERNAL
        binddn="cn=whatever"
        starttls=critical
        tls_cert=/etc/ldap/ssl/replicator-cert.pem
        tls_key=/etc/ldap/ssl/replicator-key.pem
        tls_cacert=/etc/ssl/certs/mgoc-cacert.pem
        tls_reqcert=demand
        mode=self
chain-idassert-authzFrom "*"

but when I run

$ ldappasswd -x -D 'uid=guest,ou=users,dc=server,dc=group' -wguest -stseug
Result: Authentication method not supported (7)
I'm not clear what you are trying to do with this ldapsearch command. -x disables SASL entirely. 

--Quanah



--
Greek Ordono
myppa: launchpad.net/~grexk/+archive/ppa

--- On Fri, 7/10/09, Gavin Henry <ghenry@suretecsystems.com> wrote:


From: Gavin Henry <ghenry@suretecsystems.com>
Subject: Re: saslmech=EXTERNAL
To: "Greek Ordono" <grexk@yahoo.com>
Cc: openldap-software@openldap.org
Date: Friday, July 10, 2009, 4:02 AM


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


overlay chain
chain-uri "ldaps://server.group"
chain-rebind-as-user    TRUE
chain-idassert-bind bindmethod=sasl
        saslmech=EXTERNAL
        binddn="cn=whatever"
        tls_cert=/etc/ldap/ssl/replicator-cert.pem
        tls_key=/etc/ldap/ssl/replicator-key.pem
        tls_cacert=/etc/ssl/certs/mgoc-cacert.pem
        tls_reqcert=demand
        mode=self
chain-idassert-authzFrom "*"
chain-return-error         TRUE


Is slapd listening on ldaps? Why not starttls=yes/critical like below?


[2]
syncrepl rid=245
        provider=ldap://server.group
        type=refreshAndPersist
        searchbase="dc=server,dc=group"
        filter="(objectClass=*)"
        scope=sub
        schemachecking=off
        bindmethod=sasl
        saslmech=EXTERNAL
        starttls=yes
        tls_cert=/etc/ldap/ssl/replicator-cert.pem
        tls_key=/etc/ldap/ssl/replicator-key.pem
        tls_reqcert=allow
        retry="10 20 60 +"
        logbase="cn=accesslog"
        logfilter="(&(objectClass=auditWriteObject)(reqResult=0))"
        syncdata=accesslog

--

Greek Ordono

myppa: launchpad.net/~grexk/+archive/ppa






- --
Kind Regards,

Gavin Henry.
Managing Director.

T +44 (0) 1224 279484
M +44 (0) 7930 323266
F +44 (0) 1224 824887
E ghenry@suretecsystems.com

Open Source. Open Solutions(tm).

http://www.suretecsystems.com/

Suretec Systems is a limited company registered in Scotland. Registered
number: SC258005. Registered office: 13 Whiteley Well Place, Inverurie,
Aberdeenshire, AB51 4FP.

Subject to disclaimer at http://www.suretecgroup.com/disclaimer.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkpWYfgACgkQoJwyzoTgQhTaIgCfU0vFRkoDrYCP8edFLJsERL26
hNcAoJN0JpnZHOmxQ3D6re/G1Ndr6A+s
=caYf
-----END PGP SIGNATURE-----







--

Quanah Gibson-Mount
Principal Software Engineer
Zimbra, Inc
--------------------
Zimbra ::  the leader in open source messaging and collaboration