I know, the third part is not that good, but I do this for living ;-) I'm trying to build the following architecture:
- cyrus imapd w/ multidomain support (patched myself w/ autocreate patch, expect this update shortly on mainstream). - cyrus sasl & pam_ldap - Active directory as a userbase ANY HINT/SUGGESTION IS WELCOME, I'M STUCK. If you're interested, please read on Ivan On the same machine, I run LDAP (for other purposes). The userbase is done on AD in the following way: - one OU per managed domain - each OU has uPNSuffix set to managed domain name (which is completely different from the main AD domain name). - each user has his userPrincipalName set to [EMAIL PROTECTED] Since I use AD only for userbase auth, not for all passwd stuff (uid, gid, homedir), I did not upgrade the AD Schema w/ Unix extensions (i.e. SFU). I don't (yet) use TLS I don't use GSSAPI for two reasons: - I don't know how to set it up :-( - I'm not sure if the TGT mechanism can handle a domain which is different from the master realm (the KDC is on the AD domain/realm, while the user is from a different domain) /etc/ldap.conf is configured this way: /etc/ldap.conf -------------- host 192.168.76.23 base OU=CE-MAILCustomers,OU=Customers,DC=aonet,DC=local ldap_version 3 binddn cn=sys_ldapbind,ou=service_accounts,dc=aonet,dc=local bindpw supersecret port 389 scope sub timelimit 30 bind_timelimit 30 pam_filter objectclass=User pam_login_attribute userPrincipalName pam_password ad ssl no Performing an ldapsearch, I can get almost all info on my user. ldapsearch -x -h 192.168.76.23 -D cn=sys_ldapbind,ou=service_accounts,dc=aonet,dc=local -w supersecret -b OU=CE-MAILCustomers,OU=Customers,DC=aonet,DC=local objectclass=User # extended LDIF # # LDAPv3 # base <OU=CE-MAILCustomers,OU=Customers,DC=aonet,DC=local> with scope sub # filter: objectclass=User # requesting: ALL # # ivan.brunello, ce-mail.it, CE-MAILCustomers, Customers, aonet.local dn: CN=ivan.brunello,OU=ce-mail.it,OU=CE-MAILCustomers,OU=Customers,DC=aonet ,D C=local objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: ivan.brunello givenName: ivan.brunello distinguishedName: CN=ivan.brunello,OU=ce-mail.it,OU=CE-MAILCustomers,OU=Custo mers,DC=aonet,DC=local instanceType: 4 whenCreated: 20050117153342.0Z whenChanged: 20050117153342.0Z displayName: ivan.brunello uSNCreated: 5913181 uSNChanged: 5913187 name: ivan.brunello objectGUID:: cvCZapG1SEKVYciWqZfTHw== userAccountControl: 66048 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 0 lastLogoff: 0 lastLogon: 0 pwdLastSet: 127504496225000000 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAAVTinXdr6KG38CrF5CHsAAA== accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: ivan.brunellocemail sAMAccountType: 805306368 userPrincipalName: [EMAIL PROTECTED] objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=aonet,DC=local dSCorePropagationData: 20050124083541.0Z dSCorePropagationData: 20050118143427.0Z dSCorePropagationData: 20050118143152.0Z dSCorePropagationData: 20050118142946.0Z dSCorePropagationData: 16010714223649.0Z # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 The only relevant log seems to be the following: /var/log/auth/info ------------------ Jan 25 19:43:31 smi-ld26 saslauthd[7454]: do_auth : auth failure: [user=ivan.brunellocemail] [service=imap] [realm=cemail.it] [mech=pam] [reason=PAM auth error] Any further info on demand _______________________________________________ tsl-discuss mailing list [email protected] http://lists.trustix.org/mailman/listinfo/tsl-discuss
