[Freeipa-users] authentication against compat

[Tamas Papp]

On 02/12/2014 01:34 PM, Alexander Bokovoy wrote:
> On Wed, 12 Feb 2014, Tamas Papp wrote:
>>
>> On 02/12/2014 01:07 PM, Alexander Bokovoy wrote:
>>> On Wed, 12 Feb 2014, Tamas Papp wrote:
>>>> hi All,
>>>>
>>>> $ ldapsearch -x -D uid=USER,cn=users,cn=compat,dc=foo -h localhost -w
>>>> `cat pw`
>>>> ldap_bind: Referral (10)
>>>>    referrals:
>>>>        ldap:///uid=USER,cn=users,cn=accounts,dc=foo
>>>>
>>>>
>>>>
>>>>
>>>> [12/Feb/2014:12:54:15 +0100] conn=25363 fd=79 slot=79 connection from
>>>> ::1 to ::1
>>>> [12/Feb/2014:12:54:15 +0100] conn=25363 op=0 BIND
>>>> dn="uid=USER,cn=users,cn=compat,dc=foo" method=128 version=3
>>>> [12/Feb/2014:12:54:15 +0100] conn=25363 op=0 RESULT err=10 tag=97
>>>> nentries=0 etime=0
>>>> [12/Feb/2014:12:54:15 +0100] conn=25363 op=-1 fd=79 closed - B1
>>>>
>>>>
>>>> System is Centos 6.5 and ldap was migrated from IPA 3.3 (Fedora 20).
>>>> Non-compat authentication works fine and authorization against
>>>> compat is
>>>> also fine.
>>>>
>>>>
>>>> What is err=10?
>>> slapi-nis module in RHEL 6.x (and CentOS) does not support bind against
>>> compat tree. We added this feature only in Fedora 20 (and RHEL 7 beta).
>>>
>>> In older versions slapi-nis issues LDAP referral to the original LDAP
>>> entry with the hope that an LDAP client would follow it and perform a
>>> bind against the referral.
>>>
>>> Unfortunately, there is virtually no client software that supports the
>>> referral on bind operation.
>>>
>>> In short, you cannot do LDAP bind against compat tree in RHEL before
>>> 7.0.
>>
>> I forgot to mention, the client would be Ubuntu 12.04 and it
>> works/worked with IPA 3.3 and F20.
> It worked with IPA 3.3 because of what I wrote above -- I implemented
> LDAP BIND authentication in slapi-nis in IPA 3.3 instead of issuing LDAP
> referral to the original entry's DN.
>
>> If I understand correctly, you're referring to the client side, are you?
> No.
>
>> Or it is true for the server side as well?
> It is purely server-side issue. slapi-nis < 0.47.5 does not support
> proper authentication against compat tree that LDAP clients understand.

Actually I'd like to authenticate shell users on Ubuntu.

For the records I figured out, that switching from nscd to nslcd did the
trick.


Thanks,
tamas