Hi, I'm using openldap 2.4.19 to set up an ldap server with sasl, but I get some problems.
I followed the instruction in http://www.openldap.org/doc/admin24/sasl.html to do the installation. 1. I install cyrus-sasl-2.1.22 successfully, and use the Cyrus SASL sample_client and sample_server to test my SASL installation before attempting to make use of it with OpenLDAP Software. 2. Then I install openldap with commands: #export CPPFLAGS="-I/usr/local/BerkeleyDB.4.8/include -I/usr/local/sasl2/include" #export LDFLAGS="-L/usr/local/BerkeleyDB.4.8/lib -L/usr/local/sasl2/lib -L/usr/local/sasl2/lib/sasl2" # export LD_LIBRARY_PATH="/usr/local/BerkeleyDB.4.8/lib" #./configure --prefix=/usr/local/openldap --sysconfdir=/etc/openldap --enable-passwd --enable-wrappers --disable-ipv6 --enable-spasswd --enable-crypt --enable-modules --enable-accesslog=yes #make depend #make #make test #make install #cp /usr/local/openldap/var/openldap-data/DB_CONFIG.example /usr/local/openldap/var/openldap-data/DB_CONFIG there is no error while install. 3. Then I configure the slapd.conf to be like this: include /usr/local/openldap/schema/core.schema include /usr/local/openldap/schema/cosine.schema include /usr/local/openldap/schema/inetorgperson.schema include /usr/local/openldap/schema/openldap.schema include /usr/local/openldap/schema/nis.schema pidfile /usr/local/openldap/slapd.1.pid argsfile /usr/local/openldap/slapd.1.args authz-policy to sasl-regexp "^uid=([^,]+),.*" "uid=$1,cn=bjims31,cn=digest-md5,cn=auth" database bdb suffix "dc=example,dc=com" rootdn "uid=111,cn=digest-md5,cn=auth" 4. Then I use 'saslpasswd2 -c liji1' to add a user and create /usr/lib/sasl2/slapd.conf with content: pwcheck_method: auxprop auxprop_plugin: sasldb mech_list: plain login ntlm cram-md5 digest-md5 5. Then I start slapd with command 'slapd -d 1', and run ldapwhoami with command: 'ldapwhoami -h localhost -U root -Y DIGEST-MD5 -p 389', but fails with reason: user not found: no secret in database. The log of slapd is: slap_listener_activate(7): >>> slap_listener(ldap:///) connection_get(12): got connid=1 connection_read(12): checking for input on id=1 ber_get_next ber_get_next: tag 0x30 len 32 contents: op tag 0x60, time 1276849696 ber_get_next conn=1 op=0 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt ({m) ber: ber_scanf fmt (}}) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_bind: dn () SASL mech DIGEST-MD5 SASL [conn=1] Debug: DIGEST-MD5 server step 1 send_ldap_sasl: err=14 len=180 send_ldap_response: msgid=1 tag=97 err=14 ber_flush2: 233 bytes to sd 12 <== slap_sasl_bind: rc=14 connection_get(12): got connid=1 connection_read(12): checking for input on id=1 ber_get_next ber_get_next: tag 0x30 len 296 contents: op tag 0x60, time 1276849697 ber_get_next conn=1 op=1 do_bind ber_scanf fmt ({imt) ber: ber_scanf fmt ({m) ber: ber_scanf fmt (m) ber: ber_scanf fmt (}}) ber: >>> dnPrettyNormal: <> <<< dnPrettyNormal: <>, <> do_bind: dn () SASL mech DIGEST-MD5 SASL [conn=1] Debug: DIGEST-MD5 server step 2 slap_sasl_getdn: u:id converted to uid=liji1,cn=DIGEST-MD5,cn=auth >>> dnNormalize: <uid=liji1,cn=DIGEST-MD5,cn=auth> <<< dnNormalize: <uid=liji1,cn=digest-md5,cn=auth> ==>slap_sasl2dn: converting SASL name uid=liji1,cn=digest-md5,cn=auth to a DN ==> rewrite_context_apply [depth=1] string='uid=liji1,cn=digest-md5,cn=auth' ==> rewrite_rule_apply rule='^uid=([^,]+),.*' string='uid=liji1,cn=digest-md5,cn=auth' [1 pass(es)] ==> rewrite_context_apply [depth=1] res={0,'uid=liji1,cn=bjims31,cn=digest-md5,cn=auth'} slap_parseURI: parsing uid=liji1,cn=bjims31,cn=digest-md5,cn=auth ldap_url_parse_ext(uid=liji1,cn=bjims31,cn=digest-md5,cn=auth) >>> dnNormalize: <uid=liji1,cn=bjims31,cn=digest-md5,cn=auth> <<< dnNormalize: <uid=liji1,cn=bjims31,cn=digest-md5,cn=auth> <==slap_sasl2dn: Converted SASL name to uid=liji1,cn=bjims31,cn=digest-md5,cn=auth slap_sasl_getdn: dn:id converted to uid=liji1,cn=bjims31,cn=digest-md5,cn=auth SASL [conn=1] Failure: no secret in database send_ldap_result: conn=1 op=1 p=3 send_ldap_response: msgid=2 tag=97 err=49 ber_flush2: 70 bytes to sd 12 <== slap_sasl_bind: rc=49 connection_get(12): got connid=1 connection_read(12): checking for input on id=1 ber_get_next ber_get_next on fd 12 failed errno=0 (Success) connection_close: conn=1 sd=12 What am I doing wrong? Thanks liji
