Re: Problem when trying to authenticate squid with openldap server

To: Buchan Milne <bgmilne@staff.telkomsa.net>

Subject: Re: Problem when trying to authenticate squid with openldap server

From: Bruno Lamps <lampss@gmail.com>

Date: Fri, 26 Nov 2010 10:23:20 -0300

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:mime-version:received:in-reply-to :references:from:date:message-id:subject:to:cc:content-type; bh=VlC14FTjoqHOLFj88JjLuHT2Sp1j8VwBcmvNToDK3Hs=; b=DUN5mdW8zan24JwypfTNrbhuhqDcdgSQ095NCBoiYi+2tOs40FyqQGaHqVY/GYNVs3 EUtPCGTRIpaRclkZ+plvLja2PfDl2rij90+iH+XOtwvz3oVeA5gu3guuJyAoDRyR4UxQ HCMapeBFtQAeWmhImRc9wadAKjb+WAyWjmVMg=

Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=ratbu1YBQCc8f30AsriRwOGl4F25M43k87C+QLVlFmk9moi6YfHqNBQr+p8bXHsx/e M1gkhiHDXOHMQLe7L+2dc+dG8KZeer0RBPhtpv2mILk3rgB7fZ3i+4D3mod0PX4naxVj Mr44calX31pBTiEa8CMWIAcvJE13LSAeDzPPs=

In-reply-to: <201011261127.33588.bgmilne@staff.telkomsa.net>

References: <AANLkTimC5H-1ORBVwPoc5cRtOfg3W_n_L+bwjY+ebr_L@mail.gmail.com> <201011261127.33588.bgmilne@staff.telkomsa.net>

Thanks Dieter Kluenter and Buchan Milne for answering to this, and everyone else that is reading this topic. =D

It seems your ACLs are not sufficient for *any* simple binds to this DN.

Please test the following on your LDAP server:

$ ldapwhoami -x -D uid=lamps,ou=usuarios,dc=pisolar -W

Until this command works, please don't bother with anything related to squid.

Right, this command isn't working for any user, except cn=admin,dc=pisolar. I'm struggling with /etc/ldap/slapd.conf, to solve this. I probably tried to make the ACLs a bit too tight, and now they're choking me. =p

Did you ever test simple binds to your LDAP server as these users except from

squid? It doesn't seem like it ...

I use this ldap base to authenticate my GLPI () system. But I think GLPI just grab all my base, using the ldap admin password, and transports it to it's mysql database. =/

I'm currently testing different ACLs in /etc/ldap/slapd.conf. Right now, these are the rules:

access to *

by dn="cn=admin,dc=pisolar" write

#by anonymous none

#by self none

by * read

access to attrs=userPassword,shadowLastChange

by dn="cn=admin,dc=pisolar" write

by anonymous auth

by self write

by * none

access to dn.base="" by * read

What kind of mistake am I doing there? =S

Once again, thank you all for helping me. ;]