|
Bruce,
My SASL authentication is working... I am still confused on how to setup OpenLDAP to pass ALL attempts through to SASL. The only method I've found is to create users in a local OpenLDAP database and set the userPassword attribute to {SASL}username@REALM. What am I missing here? > Date: Tue, 14 Oct 2014 16:23:26 -0700 > Subject: Re: OpenLDAP as proxy to Active Directory backend > From: bruce.carleton@dena.com > To: jeflebo@outlook.com > CC: openldap-technical@openldap.org > > Jeff, > > The basic functionality is there. You can tell OpenLDAP to use SASL > for authentication, against any available SASL mechanism that's > supported on your platform. Part of the story is here: > > http://www.openldap.org/doc/admin24/security.html#Pass-Through authentication > > Pay very close attention to paragraph 14.5.1. That little SASL config > file (not part of OpenLDAP) will stop the show if it's not right. > > I almost had it working, but I couldn't do it, because I still needed > local LDAP password hashes in my use case. I couldn't get the "{SASL}" > password value to work for some reason. Turning on SASL pass-through > seemed to be an all or nothing choice in my case. You will probably > have to do some work to get it up and running. > > Best, > > --Bruce > > On Tue, Oct 14, 2014 at 1:46 PM, Jeff Lebo <jeflebo@outlook.com> wrote: > > Goal: LDAP server in Internet facing DMZ to provide authentication for > > externally hosted applications using internal AD credentials. > > > > I've done a LOT of reading and testing, and there is one thing I am still > > not 100% clear on: > > > > Is it possible to do this WITHOUT having a local user database on the > > OpenLDAP proxy? We will have thousands of users that will need to > > authenticate, and I can't maintain another user database (adds, removes, > > etc..). Is there a way to make OpenLDAP just act more like a reverse proxy > > and forward anything that matches a specific domain on to the internal > > LDAP/AD server for password verification? > |