Re: Syncrepl authentication via GSSAPI/SASL/Kerberos

[Steven Presser <steve@pressers.name>]

No; That bind DN is used only in simple authentication.  I am 
maintaining them as separate accounts, for the time being.  One of my 
ACLs is:

access to *
        by dn.exact="cn=repl,dc=pressers,dc=name" read
        by dn.exact="uid=ldap/mordor.pressers.name, 
cn=pressers.name,cn=gssapi,cn=auth" read
        by * break

Which I think ought to cover the permissions required pretty well. As 
you can see, they have identical permissions.

Also, I just noticed an error introduced by copy-paste in my last 
email.  In both configs there is a floating "i" on the searchbase line.  
That "i" belongs at the end of "GSSAP" on the saslmech line.

Thanks,
Steve


On 09/30/2014 01:22 PM, Quanah Gibson-Mount wrote:
> --On Tuesday, September 30, 2014 2:14 PM -0400 Steven Presser 
> <steve@pressers.name> wrote:
>
> > Hi,
> >
> > I'm running a pair of OpenLDAP servers on a network which primarily uses
> > kerberos for authentication.  The two servers replicate data (via a
> > simple syncrepl master-slave setup).  Right now, they're using simple
> > authentication.  I'd like to move them to using kerberos authentication.
> >
> > I've successfully gotten them to the point where the kerberos
> > authentication (appears) to succeed.  However, replication doesn't 
> > happen
> > with the mysterious error "findbase failed! 32".  I have found no 
> > mention
> > of this error, other than a couple of permissions-related errors.  I
> > double-checked my permissions, so it's not that.
> >
> > I've copied relevant portions of my slapd.conf below and would be happy
> > to provide more if required.  I also have a syslog excerpt below.
> >
> > Does anyone know what I should be looking at next or have an example 
> > of a
> > functional setup similar to what I've described?
>
> It doesn't look like you've set up SASL regexp's correctly or you 
> didn't define your ACLs correctly for the SASL bind ID:
>
> Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=2 BIND 
> authcid="ldap/mordor.pressers.name" authzid="ldap/mordor.pressers.name"
> Sep 30 13:11:09 hawking slapd[1620]: conn=1005 op=2 BIND 
> dn="uid=ldap/mordor.pressers.name,cn=gssapi,cn=auth" mech=GSSAPI 
> sasl_ssf=56 ssf=56
>
> As you can see, your replication DN was:
>
>        binddn="cn=repl,dc=pressers,dc=name"
>
> --Quanah
>
>
>
> --
>
> Quanah Gibson-Mount
> Server Architect
> Zimbra, Inc.
> --------------------
> Zimbra ::  the leader in open source messaging and collaboration

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature