Re: SASL Proxy Authorization

To: Dan White <dwhite@olp.net>

Subject: Re: SASL Proxy Authorization

From: Vishesh kumar <linuxtovishesh@gmail.com>

Date: Tue, 25 Jun 2013 19:51:02 +0530

Cc: "openldap-technical@openldap.org" <openldap-technical@openldap.org>

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=PGQLGNLqNfIeTsZNO3L8unV+k/tdVXkOnqMKJ0ucty4=; b=YT3HXu69H+AbUwHILgW5dNfa7XFszl9p8XcnoCAvV4J+MP1AssFKRW4fOpsuwqowq2 XwU0kcwECd0DeuRKQchtB6FB5fuM1gO27CTdJQ1mqSu4rirDoD7SZaQZ7H5kdg3RVPVW CrQVOcMA3F6/1nCPFkXWm0XeTMm8covNYq1QdV82pWBn7XLHPPficHOpWgAfim7iqLg1 lQUtJx265KmAYdn6w2RtZSiLiIqAWaishFekM0yQYC2aY2wF8n6H0vvjhkkfUQm0N61c l/KFMEhJIY4vCKGHCnKt+D7gFtyohh/GAI5zCcAyAEYHsFEGuEvfsJVfdjqCZIwR1XTE KPbg==

In-reply-to: <20130625141918.GA6930@dan.olp.net>

References: <CAKpaJ1xCkrLDf+ZBESAGb2Ji4OoT1mLc4uxbpae6FSzenh=Okg@mail.gmail.com> <20130625141918.GA6930@dan.olp.net>

I able to resolve it. Thanks for info.

On Tue, Jun 25, 2013 at 7:49 PM, Dan White <dwhite@olp.net> wrote:

On 06/25/13 18:04 +0530, Vishesh kumar wrote:

Hi Members,

I am trying to get SASL Proxy Authorization in work. GSSAPI authentication
is already in place
++++++++++++

SASL/GSSAPI authentication started
SASL username: admin@LINUXMANTRA.LOCAL
SASL SSF: 56
SASL data security layer installed.
dn:uid=admin,cn=gssapi,cn=auth
++++++++++++++++++++++++++

Do you actually have an entry of uid=admin,cn=gssapi,cn=auth in your tree?
If not, it should map to an actual entry (with authz-regexp), if you are
using authzTo for proxy auth.

But following command giving error
ldapsearch -d 1 -Y GSSAPI -X "uid=vishesh,dc=linuxmantra,dc=local"
-b"dc=linuxmantra,dc=local" -s base

Your -X option should be "dn:uid=vishesh,dc=linuxmantra,dc=local". See the
manpage for ldapsearch, and chapter 15 of the Admin Guide on the website.

I already mentioned "authzTo: dn:uid=vishesh,dc=linuxmantra,dc=local" for
admin DN.

--
Dan White

--
http://linuxmantra.com

References:

SASL Proxy Authorization
- From: Vishesh kumar <linuxtovishesh@gmail.com>
Re: SASL Proxy Authorization
- From: Dan White <dwhite@olp.net>