TSLAuth - Revision history

Craig at 12:33, 28 April 2010

2010-04-28T12:33:51Z

Craig: /* Testing */

2009-12-22T16:45:43Z

Testing

Craig: /* Testing */

2009-12-22T16:45:15Z

Testing

Craig: /* Slapd Configuration */

2009-12-22T16:43:42Z

Slapd Configuration

Craig: /* Slapd Configuration */

2009-12-22T16:43:15Z

Slapd Configuration

Craig: /* Slapd Configuration */

2009-12-22T16:42:47Z

Slapd Configuration

Craig at 16:34, 22 December 2009

2009-12-22T16:34:44Z

Craig: /* SASL Configuration */

2009-12-22T16:30:35Z

SASL Configuration

Craig: /* SASL Configuration */

2009-12-22T16:24:25Z

SASL Configuration

Craig at 16:22, 22 December 2009

2009-12-22T16:22:05Z

@@ Line 108: / Line 108: @@
   tls_ca_file: /etc/saslauthd/cs-ca.crt
   tls_reqcert: allow
 ==== Testing ====

← Older revision		Revision as of 16:45, 22 December 2009
Line 121:		Line 121:
	These the slapd pass-through authentication:		These the slapd pass-through authentication:

−	ldapsearch -x -h auth1.tsl.uct.ac.za -b "ou=people,dc=~~nodomain~~" -D "cn=Craig Balfour,ou=people,dc=tsl,dc=uct,dc=ac,dc=za" -w xxx	+	ldapsearch -x -h auth1.tsl.uct.ac.za -b "ou=people,dc=tsl,dc=uct,dc=ac,dc=za" -D "cn=Craig Balfour,ou=people,dc=tsl,dc=uct,dc=ac,dc=za" -w xxx

← Older revision		Revision as of 16:45, 22 December 2009
Line 121:		Line 121:
	These the slapd pass-through authentication:		These the slapd pass-through authentication:

−	ldapsearch -x -h ~~saco1~~.cs.uct.ac.za -b "ou=people,dc=nodomain" -D "cn=Craig Balfour,ou=people,dc=~~nodomain~~" -w xxx	+	ldapsearch -x -h auth1.tsl.uct.ac.za -b "ou=people,dc=nodomain" -D "cn=Craig Balfour,ou=people,dc=tsl,dc=uct,dc=ac,dc=za" -w xxx

@@ Line 60: / Line 60: @@
 Here is a sample of a full user:
-  dn: cn=Craig Balfour,ou=people,dc=nodomain
+  dn: cn=Craig Balfour,ou=people,dc=tsl,dc=uct,dc=ac,dc=za
   objectClass: inetOrgPerson
   objectClass: posixAccount

@@ Line 73: / Line 73: @@
   loginShell: /bin/bash
   structuralObjectClass: inetOrgPerson
   userPassword: {SASL}01247611

@@ Line 49: / Line 49: @@
 ==== Slapd Configuration ====
-To run the maximum debugging:
+No special slapd configuration is required. Slapd hands have authentication to the sasl2 libraries in it finds a password beginning with {SASL}. It uses the bit after the {SASL} as the username and realm. In our case we will not use realms so the username.
-slapd -g openldap -u openldap -f /etc/ldap/slapd.conf -d 65535
+Setup a normal LDAP domain with a base of dc=tsl,dc=uct,dc=ac,dc=za. Use GQ or phpldapadmin for simplify management.
-Create a user object and set the userPassword attribute to {SASL}username where username is the username on the remote LDAP system.
+The LDAP userPassword attribute will look like this:
 ==== SASL Configuration ====

@@ Line 89: / Line 89: @@
 ==== Testing ====
-=== saslauthd ===
+Test the saslauthd configuration:
-=== slapd pass-through authentication ===
+ testsaslauthd -u 01247611 -p xxx
 ldapsearch -x -h saco1.cs.uct.ac.za -b "ou=people,dc=nodomain" -D "cn=Craig Balfour,ou=people,dc=nodomain" -w xxx

@@ Line 61: / Line 61: @@
 This configuration includes the configuration of saslauthd and the libsasl2.
-/usr/lib/sasl2/slapd.conf (libsasl2 configuration file):
+Configure /usr/lib/sasl2/slapd.conf (libsasl2 configuration file) as follows:
   mech_list: plain
@@ Line 68: / Line 68: @@
 Notes:
-- When userPassword attribute begins with {SASL} slapd passes authentication over the the libsasl2 libraries.
+* When userPassword attribute begins with {SASL} slapd passes authentication over the the libsasl2 libraries. Local only accounts with have {MD5} passwords.
-- chmod a+rx /var/run/saslauthd and /etc/init.d/apparmor stop so that slapd can read the saslauthd socket
+* Add openldap user to sasl group (and chmod a+rx /var/run/saslauthd?) and /etc/init.d/apparmor stop so that slapd can read the /var/run/saslauthd/mux socket.
-- Before starting saslauthd export LDAPTLS_REQCERT=allow (needs to be added to /etc/init.d/saslauthd)
+* Before starting saslauthd export LDAPTLS_REQCERT=allow (needs to be added to /etc/init.d/saslauthd). Might be able to add this to the global LDAP client configuration on the authentication server.
-ldap_servers: ldap://callisto.cs.uct.ac.za/
+Configure /etc/saslauthd.conf as follows:
 ldap_version: 3
-ldap_search_base: ou=people,dc=cs,dc=uct,dc=ac,dc=za
+ ldap_servers: ldaps://srvslsidm001.uct.ac.za/ ldaps://srvslsidm002.uct.ac.za/
-ldap_scope: sub
+ ldap_version: 3
-ldap_auth_method: bind
+ ldap_search_base: ou=users,o=uct
-ldap_filter: (uid=%u)
+ ldap_scope: sub
 ==== Testing ====

@@ Line 63: / Line 63: @@
 /usr/lib/sasl2/slapd.conf (libsasl2 configuration file):
-mech_list: plain
+ mech_list: plain
-pwcheck_method: saslauthd
+ pwcheck_method: saslauthd
-saslauthd_path: /var/run/saslauthd/mux
+ saslauthd_path: /var/run/saslauthd/mux
 Notes: