> On 14 Apr 2020, at 05:22, Kyle Brantley <kyle@averageurl.com> wrote:
>
> Log here, but it's not really any more illuminating: https://paste.centos.org/view/raw/ec0588a0
> And filtered down to just lines that contain 'sasl': https://paste.centos.org/view/raw/ea345620
>
> From what I can tell, the first time the SASL identity is shown in any form, the realm is absent. Timestamp of my "ldapwhois" is 13:04:52. Timestamp of me changing the logging back to 0 is 13:05:42.
>
>>>>
>>>> - SASL mapping:
>>>> nsSaslMapRegexString: \(.*\)@\(.*\)\.\(.*\)
>>>> nsSaslMapFilterTemplate: (cn=\1)
>>>> nsSaslMapBaseDNTemplate: ou=accounts,dc=app,dc=averageurl,dc=com
>>>>
>>>> - Alternative SASL mapping that I'd prefer to use:
>>>> nsSaslMapRegexString: \(.*\)@AVERAGEURL\.COM
>>>> nsSaslMapFilterTemplate: (cn=\1)
>>>> nsSaslMapBaseDNTemplate: ou=accounts,dc=app,dc=averageurl,dc=com
>>>>
Hi there,
The SASL mappings that are provided by default make a lot of assumptions, and honestly, I don't really like them :)
1: remove all sasl maps that exist under cn=mapping,cn=sasl,cn=config
2: Create your map as:
cn=krb,cn=mapping,cn=sasl,dc=config
cn: krb
nsSaslMapRegexString: \(.*\)
nsSaslMapBaseDNTemplate: ou=account,dc=....
nsSaslMapFilterTemplate: (uid=\1)
3: restart your instance
4: check if that works :)
According to my notes, there is a bug in sasl where with gssapi/krb it doesn't pass the realm through correctly, so your map needs to omit it.
—
Sincerely,
William Brown
Senior Software Engineer, 389 Directory Server
SUSE Labs
_______________________________________________
389-users mailing list -- 389-users@lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org
No comments:
Post a Comment