Re: OpenLDAP authenticate the username/password with MS-AD?

To: Dan White <dwhite@olp.net>

Subject: Re: OpenLDAP authenticate the username/password with MS-AD?

From: OSHIM <mhoshim@gmail.com>

Date: Sun, 18 Jul 2010 23:52:04 +0600

Cc: "andrew.findlay@skills-1st.co.uk" <andrew.findlay@skills-1st.co.uk>, "openldap-technical@openldap.org" <openldap-technical@openldap.org>

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:references:message-id:from:to :in-reply-to:content-type:content-transfer-encoding:x-mailer :mime-version:subject:date:cc; bh=3dzBI99OmDdjOEArt8nwWFUIbtPdUwuhRBUkzzq2oqg=; b=PKMoN9wrC32f8f8tdCG54gykZcau+nfylRNh/9tHb4BaFzqOJMpNG4Aobz5pf9d6Gm qXDHiN6pYs2kchYcOCZVoZ/nYSBzK8r0k3fMYWwTk7fSXd5VMNkQTW0suZGKny7urlaE cvyI1lg593BYGpxCV8kTlC2LiBbIArbegrcig=

Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=references:message-id:from:to:in-reply-to:content-type :content-transfer-encoding:x-mailer:mime-version:subject:date:cc; b=JhMZwBkvNQWh76daHkC+uhKmPGhGyDYRG9qyRlkFh7S7B7fapBSPaPrQ1Se3W7HxxS getvniXyotY78EmLbgHujaZyso38yLKmefxnlT/F5LrDdhD/XgQE+kAOf+nmTog/MVZi /UYNWnLASzeammwljQ+/st+NKNjWPXoxbF9dY=

In-reply-to: <20100718173105.GE12404@dan.olp.net>

References: <E4481F58-15BD-4F86-9F79-194097713D79@gmail.com> <20100718173105.GE12404@dan.olp.net>

What we want to achieve is user using services like OpenVPN, webproxy, emails, file sharing, etc will only need to remember their MS AD password and they will be able to login to the corresponding services they are entitle to used. In order to do so, we will need to configure OpenLDAP on Linux to authenticate with MS AD server. OpenLDAP will contain the user information but authentication will come from MS AD.

Sent from my iPad

On Jul 18, 2010, at 11:31 PM, Dan White <dwhite@olp.net> wrote:

On 18/07/10 21:08 +0600, OSHIM wrote:
Hi,
I need a help from you guys.
Anyone know how to customize Squid, Dansguardian, Postfix, Samba to use OpenLDAP and let OpenLDAP authenticate the username/password with MS-AD?

When performing SASL binds against OpenLDAP, you can configure
/usr/lib/sasl2/slapd.conf with:

pwcheck_method: saslauthd
mech_list: plain login

and configure /etc/saslauthd.conf with:

ldap_servers: ldap://192.0.2.1/ ldap_use_sasl: yes ldap_mech: DIGEST-MD5
and consequently you would configure your /etc/postfix/sasl/smtpd.conf
with:

pwcheck_method: saslauthd
mech_list: plain login

Configuring identical contents for /etc/saslauthd.conf on your Postfix
server would authenticate directly to the MS-AD server. If you really do
wish to authenticate to the OpenLDAP server and have it re-authenticate to
AD, configure your /etc/saslauthd.conf with:

ldap_servers: ldap://192.0.2.2/
ldap_use_sasl: yes
ldap_mech: PLAIN

Where 192.0.2.2 is the address of your slapd server. You would also want to
configure an SSL/TLS protection layer to protect the transmission of your
passwords to the slapd server.

See Chapter 15 (Using SASL) of the OpenLDAP administrator's guide for
authz-regexp configuration that should be necessary to complete this
approach. Also, see saslauthd/LDAP_SASLAUTHD within the cyrus sasl source
tree for saslauthd.conf documentation. For trouble shooting, see
'testsaslauthd', 'smtptest', and 'saslfinger'. The first two are
distributed with cyrus sasl, and the last is distributed by Patrick
Koetter.

I'm not familiar with configuring Squid, Dansguardian, and Samba in a
scenario like this, but I would imagine doing what you want (proxying
authentication via slapd) is going to get exponentially complex. It may
make more sense to have those applications authenticate directly to the AD
server.

--
Dan White