I'm setting up this authentication through OpenLDAP:
OpenLDAP -> Pass-through (External authentication) -> SASL -> PAM -> RSA Agent
In order to access to an application via a RSA Token.
Starting from the bottom to the top:
This is my PAM configuration:
#%PAM-1.0
auth required pam_securid.so
account sufficient pam_ldap.so
account include password-auth
password sufficient pam_ldap.so
password include password-auth
This test works great:
[root#ldap ~]# testsaslauthd -u goingsolo -p 11111111
0: OK "Success."
OpenLdap is correctly configured to works with the SASL Authenticatino in PLAIN:
[root#ldap /]# ldapsearch -h localhost -b "" -LLL -s base supportedSASLMechanisms -x
dn:
supportedSASLMechanisms: PLAIN
And the userPassword of my goingsolo user is configured with {SASL}goingsolo And if I do a SASL bind it works:
[root#datap-keldap-1-n01 /]# ldapsearch -h localhost -b dc=ldap,dc=com -U "goingsolo" -w 11111111
SASL/PLAIN authentication started
0: OK "Success."
The problem is when I perform a simple bind with -D instead of -U, I receive invalid credentials:
[root#datap-keldap-1-n01 /]# ldapsearch -h localhost -b dc=ldap,dc=com -D "cn=goingsolo,ou=People,dc=ldap,dc=com" -w 11111111
ldap_bind: Invalid credentials (49)
Also when performing a sasl bind with the full dn, the authentication fails because from the /var/lag/messages:
Mar 27 19:01:00 ldap saslauthd[11777]: do_auth : auth failure: [user=cn=goingsolo,ou=People,dc=ldap,dc=com] [service=ldap] [realm=] [mech=pam] [reason=PAM auth error]
I guess this is because it does not a translate from the full dn to the simple user (goingsolo).
Any tips on what should I check?
The problem was how OpenLdap was build (I guess wrong compiling). I tryed to reinstall it and then it worked. Be sure the SASL machanism is set to plain.
Related
I'm trying to get a simple ldapsearch query working against Google Secure LDAP without using client certificate. I'm using Ubuntu 22.04 ldap-utils.
Am I doing something obviously wrong with my query below? Assume username generated by Google is LDAPUser1 and password is RAND123 and my domain is example.com:
ldapsearch -D "LDAPUser1" -w RAND123 -b "ou=Users,dc=example,dc=com" -H ldaps://ldap.google.com:636
Whenever I run it, I get the following error:
ldap_bind: Invalid credentials (49)
additional info: Incorrect password
I've copied the username and password verbatum from the Google Secure LDAP "Access Credentials" section. It's directly below the "Certificates" section.
I would like to use ldapsearch for an authentication test to a remote Windows server from a Linux instance (Amazon Linux OS). Kerberos bind is working via GSS-API installed from package cyrus-sasl-gssapi, is there an equivalent package that can be used for GSS-SPNEGO? I would like the ability to fall back to NTLM authentication in case Kerberos is not working.
The server supports both GSSAPI and GSS-SPNEGO but from the client side it appears that GSS-SPNEGO is not available. Output from ldapsearch is shown below:
ldapsearch -H "ldap://$HOST_NAME" -b "" -s base -Y GSS-SPNEGO
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available: No worthy mechs found
Using cyrus-sasl-ntlm did not work because it appears the server does not support this:
ldapsearch -H "ldap://$HOST_NAME" -b "" -s base -Y NTLM
SASL/NTLM authentication started
ldap_sasl_interactive_bind_s: Authentication method not supported (7)
additional info: 00002027: LdapErr: DSID-0C0905ED, comment: Invalid Authentication method, data 0, v2580
Is it possible to use SPNEGO bind with ldapsearch? Or is there another way to authenticate over NTLM?
#Grant,
You need to change the -Y option to "-Y GSSAPI"
For example:
ldapsearch -H ldap://example.com -b 'DC=example,DC=com' -Y GSSAPI
I'm trying a ldapsearch.
The user is "domain\user" and the connection and bind is successfull with ApacheDirectoryStudio (see image), however I don't understand how to use the -D parameter in ldapsearch (maybe the problem is the bachslash ?).
I've tried with:
ldapsearch -h IT.xxxx.COM -D "CN=domain\user,DC=it,DC=xxxx,DC=com" -w Password -b base 'objectClass=*'
but I get the error:
ldap_simple_bind: Invalid credentials --- 80090308: LdapErr:
DSID-0C090400, comment: AcceptSecurityContext error, data 52e
Thanks for help.
Giuseppe.k
Apache-Connection
For connecting to AD over LDAP, you either specify the LDAP DN (e.g. CN=user,DC=domain) or the AD UPN (e.g. user#domain).
In your case, remove the domain from the LDAP DN:
ldapsearch -h IT.xxxx.COM -D "CN=user,DC=it,DC=xxxx,DC=com" -w Password -b base 'objectClass=*'
The domain is already represented by DC=it,DC=xxxx,DC=com.
I am new to working with LDAP, and my ultimate goal is to offer LDAP single sign-on in a web app. In order to achieve this, I'm trying to run ldapwhoami, but I'm running into issues. I am able to run other commands, like ldapsearch and ldapadd.
I'm running OpenLdap on Mac OS High Sierra.
My relevant slapd.conf looks like this:
access to *
by self write
by * read
by anonymous auth
database ldif
suffix "dc=test,dc=com"
directory openldap-data
rootdn "cn=admin,dc=test,dc=com"
## rootpw = secret
rootpw {SSHA}fFjKcZb4cfOAcwSjJer8nCGOEVRUnwCC
I then added a user with ldapadd -x -w secret -f shanson.ldif, where shanson.ldif looks like:
dn: cn=shanson,dc=test,dc=com
objectClass: inetOrgPerson
sn: Hanson
uid: shanson
cn: shanson
userPassword: secret
I am successfully able to search for and find this new user with ldapsearch -x "(cn=shanson)".
Now, I am trying to verify the user's credentials using ldapwhoami, and I keep getting an error:
> ldapwhoami -x -D cn=shanson,dc=test,dc=com -w secret
ldap_bind: Invalid credentials (49)
The same operation with my root admin user succeeds:
> ldapwhoami -x -D cn=admin,dc=test,dc=com -w secret
dn:cn=admin,dc=test,dc=com
I'm sure I'm just making a simple mistake or not understanding what I'm doing, but I don't really know where else to look right now for answers. Thanks!
It seems to have had something to do with the plain text password I set up. I installed Jxplorer and manually updated my user's password and hashed it with MD5, and now the ldapwhoami command works. If I set the password as plain text in JXplorer, ldapwhoami still does not work. Beyond that, I'm not entirely sure what I was doing wrong.
For me, my dn was wrong.
I did an ldapsearch with admin credentials to get the dn: uid=xxx,ou=xxx,dc=xxx,dc=xxx,dc=xxx
Then I did an ldapwhoami -x -D "uid=xxx,ou=xxx,dc=xxx,dc=xxx,dc=xxx" -w secret and it worked fine.
Here is my LDAP ORG Structure:
I created user with first, last name with password. But it is not working when am trying to connect using jdbc. Error says invalid credentials. Then I tried ldapsearch as follows:
I followed this process for users and group creation:
root#ip:/home# ldapwhoami
SASL/DIGEST-MD5 authentication started
Please enter your password:
ldap_sasl_interactive_bind_s: Invalid credentials (49)
additional info: SASL(-13): user not found: no secret in database
root#ip:/# ldapsearch -x -LLL -h ip -D username -w password -b"cn=admin,dc=ivhdev,dc=local" -s sub "(objectClass=*)" "givenName=username*"
ldap_bind: Invalid DN syntax (34)
additional info: invalid DN
Please suggest/correct me, if am passing the right info in DN syntax. I am unable to validate the user credentials with their name and password.
The -D option takes the DN for logging in to your LDAP server.
The -b option takes the search base in your LDAP tree where you want to search for the user's given name.
So, your ldapsearch command becomes:
ldapsearch -x -LLL -h ip -D 'cn=admin,dc=ivhdev,dc=local' -w password -b 'dc=users,dc=local' -s sub '(objectClass=*)' 'givenName=username*'
If you use the Apache Directory Studio (http://directory.apache.org/studio/) you can see the actual ldapsearch commands used by the application. Maybe this is useful for anyone.