Re: can't get slapd to do pass-through authentication

[Brent Bice <bbice@sgi.com>]

   Many thanks to everyone here.  I've got it working now.  The first 
part of the solution was finding out (thanks Dan!) that cyrus-sasl 
doesn't use prefix_dir/lib/sasl2/slapd.conf when you build from source 
unless you explicitly set --with-configdir (Aha!).

   After temporarily linking /usr/lib/sasl2 to my prefix_dir/lib/sasl2, 
it still wasn't working but that was because I'd messed with so many 
different settings in the sasl slapd.conf.  Re-reading the openldap docs 
on pass-thru authentication and going back to this worked:
mech_list: plain
pwcheck_method:	saslauthd
saslauthd_path:	/var/state/saslauthd/mux
sasl-secprops: none

Brent

Dan White wrote:
> On 05/08/10 14:00 -0700, Brent Bice wrote:
> > > >    I created a lib/sasl2/slapd.conf file again and in it specified:
> > > > pwcheck_method:    saslauthd
> > > > saslauthd_path:    /var/state/saslauthd/mux
> > >
> > > If testsaslauth works without specifying a '-f' option, then you 
> > > shouldn't
> > > need to specify saslauthd_path.
> >
> >    I didn't think so either.  I put it in just in case slapd was 
> > trying  to figure out where the socket was by reading this file.
>
> Is that /usr/lib/sasl2/slapd.conf?
>
> See if you can find out what --with-configdir option was passed to your
> cyrus sasl ./configure when it was compiled, which defaults to
> /usr/lib/sasl2 (regardless of where the libraries are actually installed).
>
> If you were not creating it in the correct location, then libsasl would
> default to using sasldb auxprop for authentication. You could create a test
> user:
>
> saslpasswd -c bbice
>
> to see if sasldb is being used.
>
> I don't think testsaslauthd uses libsasl itself, so if none of that works,
> you may still need to verify your libsasl is installed and linked
> correctly. sample-server and sample-client might help (create a
> /usr/lib/sasl2/sample.conf).
>
> You might also try a direct SASL bind against the server to see if that
> works. Add 'sasl-secprops none' to your slapd.conf, then do:
>
> ldapwhoami -Y PLAIN -U bbice ...
>
> which should also use saslauthd to authenticate, with pwcheck_method:
> saslauthd.