On 14 Apr 2020, at 05:22, Kyle Brantley <kyle(a)averageurl.com>
wrote:
Log here, but it’s not really any more illuminating:
https://paste.centos.org/view/raw/ec0588a0
And filtered down to just lines that contain ‘sasl’:
https://paste.centos.org/view/raw/ea345620
From what I can tell, the first time the SASL identity is shown in any form, the realm is
absent. Timestamp of my “ldapwhois” is 13:04:52. Timestamp of me changing the logging back
to 0 is 13:05:42.
>>>
>>> - SASL mapping:
>>> nsSaslMapRegexString: \(.*\)(a)\(.*\)\.\(.*\)
>>> nsSaslMapFilterTemplate: (cn=\1)
>>> nsSaslMapBaseDNTemplate: ou=accounts,dc=app,dc=averageurl,dc=com
>>>
>>> - Alternative SASL mapping that I'd prefer to use:
>>> nsSaslMapRegexString: \(.*\)(a)AVERAGEURL\.COM
>>> nsSaslMapFilterTemplate: (cn=\1)
>>> nsSaslMapBaseDNTemplate: ou=accounts,dc=app,dc=averageurl,dc=com
>>>
Hi there,
The SASL mappings that are provided by default make a lot of assumptions, and honestly, I
don't really like them :)
1: remove all sasl maps that exist under cn=mapping,cn=sasl,cn=config
2: Create your map as:
cn=krb,cn=mapping,cn=sasl,dc=config
cn: krb
nsSaslMapRegexString: \(.*\)
nsSaslMapBaseDNTemplate: ou=account,dc=....
nsSaslMapFilterTemplate: (uid=\1)
3: restart your instance
4: check if that works :)
According to my notes, there is a bug in sasl where with gssapi/krb it doesn't pass
the realm through correctly, so your map needs to omit it.
—
Sincerely,
William Brown
Senior Software Engineer, 389 Directory Server
SUSE Labs