Re: pass-through authentication

[Jonathan Clarke <jonathan@phillipoux.net>]

On 30/07/2010 23:28, Brent Bice wrote:
>   I tried to send this yesterday but didn't see it come back from the
> list (and didn't see any replies). So I'll try once more. Apologies if
> anyone gets this twice.
>
> I've been trying to get Pass-Through authentication to work using a
> userPassword attribute of the form {SASL}username@realm. Is there a way
> to tell slapd what pathspec to use to talk to saslauthd? (I'm guessing
> maybe it's using one path but saslauthd is using a different one for the
> socket file)
>
> I've got saslauthd running ok and can authenticate using testsaslauthd
> so I'm fairly sure saslauthd is configured right and working. And I've
> got openldap compiled with --enable-spasswd option so it ought to
> support the SASL pass-through option, right?
>
> I ran saslauthd with debugging on so I can see every auth request and
> whether it succeeds or fails and I can see it when testsaslauth connects
> and succeeds. But when I try to bind to slapd using the DN whose
> userPassword is {SASL}bbice@ldap the authentication to slapd fails and
> saslauthd doesn't show any authentication attempt at all. It's as if
> it's not even trying (or can't find) saslauthd.
>
> I ran slapd with the -d 255 option and saved the output to a file.
> Here's all the lines containing the string sasl:
>  >>> dnPretty: <cn=SASL>
> => ldap_bv2dn(cn=SASL,0)
> <= ldap_bv2dn(cn=SASL)=0
> <= ldap_dn2bv(cn=SASL)=0
> <<< dnPretty: <cn=SASL>
>  >>> dnNormalize: <cn=SASL>
> <<< dnNormalize: <cn=sasl>
> ldap_sasl_bind_s
> ldap_sasl_bind
> SASL Canonicalize [conn=1000]: authcid="bbice@ldap"
> SASL Canonicalize [conn=1000]: authcid="bbice@ldap"
> SASL Canonicalize [conn=1001]: authcid="bbice@ldap"
> SASL Canonicalize [conn=1001]: authcid="bbice@ldap"
>
> So if I'm reading that right, slapd does see that it's supposed to hand
> off the authentication to saslauthd and it has picked out the username
> and realm. But it doesn't seem to be connecting to or using saslauthd.
>
> Any ideas? What am I missing here?

slapd reads a SASL configuration file, named slapd.conf, to figure out 
how to communicate with saslauthd.

The default path for this file (by SASL standards) is 
/usr/lib/sasl2/slapd.conf, but some distributions may use other paths 
(Debian uses /etc/ldap/sasl/slapd.conf).

This file should contain at least "pwcheck_method: saslauthd", and be 
readable by slapd.

Hope this helps,
Jonathan
--
--------------------------------------------------------------
Jonathan Clarke - jonathan@phillipoux.net
--------------------------------------------------------------
Ldap Synchronization Connector (LSC) - http://lsc-project.org
--------------------------------------------------------------