Re: supportedSaslMechanisms during ADD

Am Thu, 9 Oct 2014 13:51:33 +0000
schrieb "VANOLE, MICHAEL J" <[email protected]>:

> Greetings,
>=20
> This might be more of an ldap question, but I=E2=80=99m going to try this
> list.
>=20
> I use net ldap to create new users on Sun One Directory v7 (ODSEE),
> and on openldap.
>=20
> With ODSEE I=E2=80=99m able to specify which sasl mechanism I want a user=
 to
> have like so:
>=20
>                 $adduser =3D $ldap->add( $user_dn,
>                         attr =3D> [
>                         'uid'                           =3D> $ldap_uid,
>                         'cn'                            =3D>
> "$ldap_last_name $ldap_first_name", 'givenname'
> =3D> $ldap_first_name, 'sn'                            =3D>
> $ldap_last_name, 'objectclass'                   =3D>
> ['top','person','organizationalPerson','inetorgperson'],
> 'userpassword'                  =3D> $userpass,
> 'nsaccountlock'                 =3D> 'false',
> 'supportedsaslmechanisms'       =3D>
> 'cn=3Ddefault,cn=3DDIGEST-MD5,cn=3Didentity mapping,cn=3Dconfig' ]);
>=20
> With openldap this fails with a message about sasl mechanism can only
> be applied to rootdse. I have several supported mechanisms I can
> choose from. Part of the problem might be I don=E2=80=99t know the =E2=80=
=98cn=E2=80=99 for
> them as I have above, so I tried this:
>=20
>                 $adduser =3D $ldap->add( $user_dn,
>                         attr =3D> [
>                         'uid'                           =3D> $ldap_uid,
>                         'cn'                            =3D>
> "$ldap_last_name $ldap_first_name", 'givenname'
> =3D> $ldap_first_name, 'sn'                            =3D>
> $ldap_last_name, 'objectclass'                   =3D>
> ['top','person','organizationalPerson','inetorgperson'],
> 'userpassword'                  =3D> $userpass,
> 'supportedsaslmechanisms'       =3D> 'DIGEST-MD5' ]);
>=20
> Should this work with openldap if I had the full hierarchy path the
> the sasl mechanism? What would that be on openldap if so?

If OpenLDAP has been compiled with cyrus-sasl, sasl mechanism are
declared in $HOME/sasl2/slapd.conf. On Linux this would
be /usr/lib/sasl2/slapd.conf or /etc/sasl2/slapd.conf. Read the
cyrus-sasl docs
http://www.cyrusimap.org/docs/cyrus-sasl/2.1.25/sysadmin.php
and openldap docs
http://www.openldap.org/doc/admin24/sasl.html

-Dieter

--=20
Dieter Kl=C3=BCnter | Systemberatung
http://sys4.de
GPG Key ID: E9ED159B
53=C2=B037'09,95"N
10=C2=B008'02,42"E