On 07/11/11 21:57 +0000, Gabriella Turek wrote:
Hello, I've set up an openLDAP server (2.4.23) which chains to an Active
Directory (2008). I can successfully search for users, it will find them in
Active Directory if they are not in openLDAP, but I cannot authenticate the
Active Directory users.
The error is "Invalid credentials (49)"
Everything is currently configured with clear text
ldapSearch works fine when pointed directly to the Active Directory.
The chaining configuration in the slapd.conf is:
overlay chain
chain-uri ldap://aucwdfp01.niwa.local:389
chain-rebind-as-user TRUE
chain-idassert-bind bindmethod="simple"
binddn="cn=SDT Tester,ou=NIWA Staff Accounts,ou=User
Accounts, dc=niwa,dc=local"
credentials=xxxxxxx
mode="self"
flags=non-prescriptive
chain-return-error TRUE
Does mode="none" work? If my reading of slapd-ldap(5) is correct, with any
config other than 'none', slapd will attempt to assert the proxyAuthz
control.
I checked our local AD server (2003) and it does not appear to support that
control:
ldapsearch -LLL -x -H ldap://<AD.ip> -s "base" -b "" supportedControl
dn:
supportedControl: 1.2.840.113556.1.4.319
supportedControl: 1.2.840.113556.1.4.801
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 1.2.840.113556.1.4.528
supportedControl: 1.2.840.113556.1.4.417
supportedControl: 1.2.840.113556.1.4.619
supportedControl: 1.2.840.113556.1.4.841
supportedControl: 1.2.840.113556.1.4.529
supportedControl: 1.2.840.113556.1.4.805
supportedControl: 1.2.840.113556.1.4.521
supportedControl: 1.2.840.113556.1.4.970
supportedControl: 1.2.840.113556.1.4.1338
supportedControl: 1.2.840.113556.1.4.474
supportedControl: 1.2.840.113556.1.4.1339
supportedControl: 1.2.840.113556.1.4.1340
supportedControl: 1.2.840.113556.1.4.1413
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.10
supportedControl: 1.2.840.113556.1.4.1504
supportedControl: 1.2.840.113556.1.4.1852
supportedControl: 1.2.840.113556.1.4.802
supportedControl: 1.2.840.113556.1.4.1907
supportedControl: 1.2.840.113556.1.4.1948
proxyAuthz control == 2.16.840.1.113730.3.4.18 (RFC 4370)
--
Dan White
