Frederic Hornain wrote: > Dear *, > > How can I configure the Directory server in order to use SASL > DIGEST-MD5 with ldapsearch qnd without error messages? http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Admin... SASL/DIGEST-MD5 requires that the userPassword is in clear text. > > ldapsearch -W -h xxx.xxx.xxx.xxx -U username -b "dc=example,dc=com" -Y > DIGEST-MD5 > Enter LDAP Password : xxxxx > SASL/DIGEST-MD5 authentication started > ldap_sasl_interactive_bind_s: Invalid credentials (49) > additional info: SASL(-14): authorization failure: unable canonify > user and get auxprops > > > Thanks in advance for your help and your time. > > BR > Frederic ;) > > ----------------------------------------------------- > Fedora-ambassadors-list mailing list > Fedora-ambassadors-list(a)redhat.com > <mailto:Fedora-ambassadors-list@redhat.com> > ------------------------------------------------------------------------ > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

Frederic Hornain wrote: > Dear Rich, > > It is in clear text mode. > > BR > Fred ;) > > On Tue, Oct 26, 2010 at 5:07 PM, Rich Megginson <rmeggins(a)redhat.com > <mailto:rmeggins@redhat.com>> wrote: > > Frederic Hornain wrote: > > Dear *, > > > > How can I configure the Directory server in order to use SASL > > DIGEST-MD5 with ldapsearch qnd without error messages? > http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Admin... > > SASL/DIGEST-MD5 requires that the userPassword is in clear text. > > > > ldapsearch -W -h xxx.xxx.xxx.xxx -U username -b > "dc=example,dc=com" -Y > The username must be in the form of "uid:username" or "dn:uid=username,ou=people,...suffix..." Also try -X instead of -U > > > DIGEST-MD5 > > Enter LDAP Password : xxxxx > > SASL/DIGEST-MD5 authentication started > > ldap_sasl_interactive_bind_s: Invalid credentials (49) > > additional info: SASL(-14): authorization failure: unable canonify > > user and get auxprops > > > > > > Thanks in advance for your help and your time. > > > > BR > > Frederic ;) > > > > ----------------------------------------------------- > > Fedora-ambassadors-list mailing list > > Fedora-ambassadors-list(a)redhat.com > <mailto:Fedora-ambassadors-list@redhat.com> > > <mailto:Fedora-ambassadors-list@redhat.com > <mailto:Fedora-ambassadors-list@redhat.com>> > > > ------------------------------------------------------------------------ > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org > <mailto:389-users@lists.fedoraproject.org> > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > <mailto:389-users@lists.fedoraproject.org> > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > -- > ----------------------------------------------------- > Fedora-ambassadors-list mailing list > Fedora-ambassadors-list(a)redhat.com > <mailto:Fedora-ambassadors-list@redhat.com> > Olpc mailing list > olpc-open(a)laptop.org <mailto:olpc-open@laptop.org> > ------------------------------------------------------------------------ > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

Frederic Hornain wrote: > Dear Rich, > > Unfortunatly, it does not work. > Could I ask you to do a test on your default RHDS to see if that works ? I know that DIGEST-MD5 does work. > If it works then could you provide me the corresponding openldapsearch > command ? Can you provide excerpts from your access log showing the failed bind attempt? > Thanks for your help. > > BR > Frederic ;) > > On Tue, Oct 26, 2010 at 5:21 PM, Rich Megginson <rmeggins(a)redhat.com > <mailto:rmeggins@redhat.com>> wrote: > > Frederic Hornain wrote: > > Dear Rich, > > > > It is in clear text mode. > > > > BR > > Fred ;) > > > > On Tue, Oct 26, 2010 at 5:07 PM, Rich Megginson > <rmeggins(a)redhat.com <mailto:rmeggins@redhat.com> > > <mailto:rmeggins@redhat.com <mailto:rmeggins@redhat.com>>> wrote: > > > > Frederic Hornain wrote: > > > Dear *, > > > > > > How can I configure the Directory server in order to use SASL > > > DIGEST-MD5 with ldapsearch qnd without error messages? > > > http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Admin... > > > > SASL/DIGEST-MD5 requires that the userPassword is in clear text. > > > > > > ldapsearch -W -h xxx.xxx.xxx.xxx -U username -b > > "dc=example,dc=com" -Y > > > > The username must be in the form of "uid:username" or > "dn:uid=username,ou=people,...suffix..." > Also try -X instead of -U > > > > > DIGEST-MD5 > > > Enter LDAP Password : xxxxx > > > SASL/DIGEST-MD5 authentication started > > > ldap_sasl_interactive_bind_s: Invalid credentials (49) > > > additional info: SASL(-14): authorization failure: unable > canonify > > > user and get auxprops > > > > > > > > > Thanks in advance for your help and your time. > > > > > > BR > > > Frederic ;) > > > > > > ----------------------------------------------------- > > > Fedora-ambassadors-list mailing list > > > Fedora-ambassadors-list(a)redhat.com > <mailto:Fedora-ambassadors-list@redhat.com> > > <mailto:Fedora-ambassadors-list@redhat.com > <mailto:Fedora-ambassadors-list@redhat.com>> > > > <mailto:Fedora-ambassadors-list@redhat.com > <mailto:Fedora-ambassadors-list@redhat.com> > > <mailto:Fedora-ambassadors-list@redhat.com > <mailto:Fedora-ambassadors-list@redhat.com>>> > > > > > > ------------------------------------------------------------------------ > > > > > > -- > > > 389 users mailing list > > > 389-users(a)lists.fedoraproject.org > <mailto:389-users@lists.fedoraproject.org> > > <mailto:389-users@lists.fedoraproject.org > <mailto:389-users@lists.fedoraproject.org>> > > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org > <mailto:389-users@lists.fedoraproject.org> > > <mailto:389-users@lists.fedoraproject.org > <mailto:389-users@lists.fedoraproject.org>> > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > > > > > > -- > > ----------------------------------------------------- > > Fedora-ambassadors-list mailing list > > Fedora-ambassadors-list(a)redhat.com > <mailto:Fedora-ambassadors-list@redhat.com> > > <mailto:Fedora-ambassadors-list@redhat.com > <mailto:Fedora-ambassadors-list@redhat.com>> > > Olpc mailing list > > olpc-open(a)laptop.org <mailto:olpc-open@laptop.org> > <mailto:olpc-open@laptop.org <mailto:olpc-open@laptop.org>> > > > ------------------------------------------------------------------------ > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org > <mailto:389-users@lists.fedoraproject.org> > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > <mailto:389-users@lists.fedoraproject.org> > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > -- > ----------------------------------------------------- > Fedora-ambassadors-list mailing list > Fedora-ambassadors-list(a)redhat.com > <mailto:Fedora-ambassadors-list@redhat.com> > Olpc mailing list > olpc-open(a)laptop.org <mailto:olpc-open@laptop.org> > ------------------------------------------------------------------------ > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

On 10/26/2010 9:14 AM, Frederic Hornain wrote: Rich, ldapsearch -v -h 192.168.122.142 -s sub -U uid:fhornain,ou=People,dc=example,dc=com -b "dc=example,dc=com" -Y DIGEST-MD5 ldap_initialize( ldap://192.168.122.142 ) SASL/DIGEST-MD5 authentication started Please enter your password: ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-14): authorization failure: unable canonify user and get auxprops "uid:fhornain,ou=People,dc=example,dc=com" If you use the "uid:" syntax, it should be followed by a uid, not a dn. Or you can use the "dn:" syntax if you want to use a dn. You may have other things going on here, but the way you've specified the user definitely isn't going to work. -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

Frederic Hornain wrote: > Dear Patrick, > > ldapsearch -v -h 192.168.122.142 -s sub -U > "dn:uidfhornain,ou=People,dc=example,dc=com" -b "dc=example,dc=com" -Y > DIGEST-MD5 use either -U "u:fhornain" or -U "dn:uid=fhornain,ou=People,dc=example,dc=com" > ldap_initialize( ldap://192.168.122.142 <http://192.168.122.142> ) > SASL/DIGEST-MD5 authentication started > Please enter your password: > ldap_sasl_interactive_bind_s: Invalid credentials (49) > additional info: SASL(-14): authorization failure: unable canonify > user and get auxprops > > > Thanks for you help, I appreciate. > > BR > Frederic ;) > > 2010/10/26 Morris, Patrick <patrick.morris(a)hp.com > <mailto:patrick.morris@hp.com>> > > On 10/26/2010 9:14 AM, Frederic Hornain wrote: >> Rich, >> >> >> ldapsearch -v -h 192.168.122.142 -s sub -U >> uid:fhornain,ou=People,dc=example,dc=com -b "dc=example,dc=com" >> -Y DIGEST-MD5 >> ldap_initialize( ldap://192.168.122.142 <http://192.168.122.142> ) >> SASL/DIGEST-MD5 authentication started >> Please enter your password: >> ldap_sasl_interactive_bind_s: Invalid credentials (49) >> additional info: SASL(-14): authorization failure: unable >> canonify user and get auxprops > > "uid:fhornain,ou=People,dc=example,dc=com" > > If you use the "uid:" syntax, it should be followed by a uid, not > a dn. Or you can use the "dn:" syntax if you want to use a dn. > > You may have other things going on here, but the way you've > specified the user definitely isn't going to work. > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > <mailto:389-users@lists.fedoraproject.org> > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > -- > ----------------------------------------------------- > Fedora-ambassadors-list mailing list > Fedora-ambassadors-list(a)redhat.com > <mailto:Fedora-ambassadors-list@redhat.com> > Olpc mailing list > olpc-open(a)laptop.org <mailto:olpc-open@laptop.org> > ------------------------------------------------------------------------ > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

-U fhornain ? On 10/26/2010 02:28 PM, Frederic Hornain wrote: Rich, I tried with -U "u:fhornain" or -U "dn:uid=fhornain,ou=People,dc=example,dc=com" I still have the same problem. Thanks for your help BR Frederic ;) On Tue, Oct 26, 2010 at 6:40 PM, Rich Megginson <rmeggins(a)redhat.com&gt;wrote: > Frederic Hornain wrote: > > Dear Patrick, > > > > ldapsearch -v -h 192.168.122.142 -s sub -U > > "dn:uidfhornain,ou=People,dc=example,dc=com" -b "dc=example,dc=com" -Y > > DIGEST-MD5 > use either > -U "u:fhornain" > or > -U "dn:uid=fhornain,ou=People,dc=example,dc=com" > > > ldap_initialize( ldap://192.168.122.142 <http://192.168.122.142> ) > > SASL/DIGEST-MD5 authentication started > > Please enter your password: > > ldap_sasl_interactive_bind_s: Invalid credentials (49) > > additional info: SASL(-14): authorization failure: unable canonify > > user and get auxprops > > > > > > Thanks for you help, I appreciate. > > > > BR > > Frederic ;) > > > > 2010/10/26 Morris, Patrick <patrick.morris(a)hp.com > > <mailto:patrick.morris@hp.com>> > > > > On 10/26/2010 9:14 AM, Frederic Hornain wrote: > >> Rich, > >> > >> > >> ldapsearch -v -h 192.168.122.142 -s sub -U > >> uid:fhornain,ou=People,dc=example,dc=com -b "dc=example,dc=com" > >> -Y DIGEST-MD5 > >> ldap_initialize( ldap://192.168.122.142 <http://192.168.122.142> ) > >> SASL/DIGEST-MD5 authentication started > >> Please enter your password: > >> ldap_sasl_interactive_bind_s: Invalid credentials (49) > >> additional info: SASL(-14): authorization failure: unable > >> canonify user and get auxprops > > > > "uid:fhornain,ou=People,dc=example,dc=com" > > > > If you use the "uid:" syntax, it should be followed by a uid, not > > a dn. Or you can use the "dn:" syntax if you want to use a dn. > > > > You may have other things going on here, but the way you've > > specified the user definitely isn't going to work. > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org > > <mailto:389-users@lists.fedoraproject.org> > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > > > > > > > > > -- > > ----------------------------------------------------- > > Fedora-ambassadors-list mailing list > > Fedora-ambassadors-list(a)redhat.com > > <mailto:Fedora-ambassadors-list@redhat.com> > > Olpc mailing list > > olpc-open(a)laptop.org <mailto:olpc-open@laptop.org> > > ------------------------------------------------------------------------ > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org > > https://admin.fedoraproject.org/mailman/listinfo/389-users > > -- > 389 users mailing list > 389-users(a)lists.fedoraproject.org > https://admin.fedoraproject.org/mailman/listinfo/389-users > -- ----------------------------------------------------- Fedora-ambassadors-list mailing list Fedora-ambassadors-list(a)redhat.com Olpc mailing list olpc-open(a)laptop.org -- 389 users mailing list389-users@lists.fedoraproject.orghttps://admin.fedoraproject.org/mailman/listinfo/389-users