Re: LDAP Auth

On Mon, Jun 21, 2004 at 03:18:57PM +0200, [email protected] wrote:
> Dear all,
Hello!

> I have configure LDAP auth, but i can't not check successfully the
> password.
> With other applications, example from a php intranet page, i can check
> the ldap account successfully.
> Have any a idea ?

Yes.

[...]

> 13:30:17 < 4677> config_str: s='(nil)' n='LDAPAuthPWAttr' d=''
> 13:30:17 < 4677> config_str: result='userPassword'
> 13:30:17 < 4677> config_str: s='(nil)' n='LDAPAuthPWType' d='plain'
> 13:30:17 < 4677> config_str: result='plain'
> 13:30:17 < 4677> LDAP result: 'userPassword' - ''
> 13:30:17 < 4677> TECH-DBG LDAP auth pw-type[5]='plain'
> 13:30:17 < 4677> LDAP auth pw-check: '' ?= '123456'

You are using the attic LDAPAuthPWAttr,LDAPAuthPWType keywords.
This is compatibility stuff needed only on OpenLDAP 1.x, where
the LDAP server wasn't able to verify the passwords itself and
the proxy has to verify it itself.

Comment out the LDAPAuthPWAttr and LDAPAuthPWType options
in your config and set:

    LDAPBindDN	    auto
or
    LDAPBindDN	    AuthDN

This causes the proxy to search for uid=$USER bellow of
the DN specified in LDAPAuthDN and try to bind using the
relsulting DN with username and password.

If you can't / don't like a anonymous pre-bind, use:

    LDAPPreBindDN uid=squidmgr,ou=applications,dc=domain,dc=net
    LDAPPreBindPW ***pwd***


You can also comment out the LDAPBaseDN option, except you
want that the proxy try's to read user specific config from
LDAP as well.

Further you may use the "UserAuthMagic" feature as well to
encode auth user+password in USER / PASS ftp commands;
otherwise the ftp username and ftp password are used to
bind ldap as well.

You need / should use OpenLDAP 2.x and proxy-suite-1.9.2.2.

Kind regards,
 Marius Tomaschewski <[email protected]>
--
 SUSE LINUX AG, Nuernberg  --  Product Developement
 PGP public key on:   http://www.suse.de/~mt/mt.pgp
 DF17 271A AD15 006A 5BB9  6C96 CA2F F3F7 373A 1CC0

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]