<p>
Hi all,</p>
<p>
I begin to research about DIGEST-MD5 mechanisms instead of using plaintext mechanisms. However, its features are very few. I following this site: http://www.openldap.org/doc/admin24/sasl.html, but the result is failed... or i don't understand anything about the DIGEST-MD5.</p>
<p>
Here is my result:</p>
<p>
my slapd.conf is:</p>
<p>
#<br />
# See slapd.conf(5) for details on configuration options.<br />
# This file should NOT be world readable.<br />
#<br />
include /usr/local/openldap/etc/openldap/schema/core.schema<br />
include /usr/local/openldap/etc/openldap/schema/cosine.schema<br />
include /usr/local/openldap/etc/openldap/schema/nis.schema<br />
include /usr/local/openldap/etc/openldap/schema/inetorgperson.schema<br />
include /usr/local/openldap/etc/openldap/schema/openldap.schema<br />
<br />
# Define global ACLs to disable default read access.<br />
<br />
# Do not enable referrals until AFTER you have a working directory<br />
# service AND an understanding of referrals.<br />
#referral ldap://root.openldap.org<br />
<br />
loglevel 296<br />
<br />
pidfile /usr/local/openldap/var/run/slapd.pid<br />
argsfile /usr/local/openldap/var/run/slapd.args<br />
<br />
# Misc Security Settings<br />
password-hash {SSHA}<br />
<br />
# Load dynamic backend modules:<br />
modulepath /usr/local/openldap/libexec/openldap<br />
moduleload back_bdb.la<br />
# moduleload back_hdb.la<br />
# moduleload back_ldap.la<br />
<br />
# Sample security restrictions<br />
# Require integrity protection (prevent hijacking)<br />
# Require 112-bit (3DES or better) encryption for updates<br />
# Require 63-bit encryption for simple bind<br />
<br />
# security ssf=1 update_ssf=112 simple_bind=64<br />
<br />
# Sample access control policy:<br />
# Root DSE: allow anyone to read it<br />
# Subschema (sub)entry DSE: allow anyone to read it<br />
# Other DSEs:<br />
# Allow self write access<br />
# Allow authenticated users read access<br />
# Allow anonymous users to authenticate<br />
# Directives needed to implement policy:<br />
# access to dn.base="" by * read<br />
# access to dn.base="cn=Subschema" by * read<br />
# access to *<br />
# by self write<br />
# by users read<br />
# by anonymous auth<br />
#<br />
# if no access controls are present, the default policy<br />
<br />
# allows anyone and everyone to read anything but restricts<br />
# updates to rootdn. (e.g., "access to * by * read")<br />
#<br />
# rootdn can always read and write EVERYTHING!<br />
<br />
#######################################################################<br />
# BDB database definitions<br />
#######################################################################<br />
<br />
sasl-regexp<br />
uid=(.*),cn=abc.com,cn=digest-md5,cn=auth<br />
uid=$1,ou=network,dc=abc,dc=com<br />
<br />
database bdb<br />
suffix "dc=abc,dc=com"<br />
rootdn "cn=rootldap,dc=abc,dc=com"<br />
# Cleartext passwords, especially for the rootdn, should<br />
# be avoid. See slappasswd(8) and slapd.conf(5) for details.<br />
<br />
# Use of strong authentication encouraged.<br />
rootpw {SSHA}QBEsoednrePQ/Lu5a90Nv4hbsC+BWVkK<br />
# The database directory MUST exist prior to running slapd AND<br />
# should only be accessible by the slapd and slap tools.<br />
# Mode 700 recommended.<br />
directory /usr/local/openldap/var/openldap-data<br />
mode 0600<br />
<br />
# Indices to maintain<br />
index objectClass eq<br />
index uid eq<br />
index cn,gn,mail eq,sub<br />
index sn eq,sub<br />
index ou eq<br />
index default eq,sub<br />
<br />
I want to store secret in LDAP directory, so i use password-hash {SSHA}.</p>
<p>
I think if i use to ./slapadd that mean a store secret in SASLdb, but i just want it in LDAP directory, so I use:</p>
<p>
./ldapadd -x -D cn=rootldap,cn=abc,cn=com -f quanly.ldif -W</p>
<p>
./ldapadd -x -D cn=rootldap,cn=abc,cn=com -f nhanvien.ldif -W</p>
<p>
and it successfull.</p>
<p>
When i try to use ldapsearch:</p>
<p>
./ldapsearch -Y digest-md5 -U khanhnq</p>
<p>
SASL/DIGEST-MD5 authentication started<br />
Please enter your password:<br />
ldap_sasl_interactive_bind_s: Invalid credentials (49)<br />
additional info: SASL(-13): user not found: no secret in database<br />
</p>
<p>
It said that no secret in database while I used ./ldapadd to add it...</p>
<p>
I... I really don't understand about digest-md5. I'm so stupid...</p>
<p>
Please help,</p>
<p>
My nhanvien.ldif:</p>
<p>
dn: cn=Khanh Nguyen,ou=network,dc=abc,dc=com<br />
objectclass: inetOrgPerson<br />
cn: Khanh Nguyen<br />
cn: Khanh Nguyen Quoc<br />
sn: Khanh<br />
uid: khanhnq<br />
userpassword: 123456<br />
mail: khanhnq@abc.com<br />
mail: nqk28703@yahoo.com<br />
mail: khanhnq@saigontech.edu.vn<br />
ou: network<br />
<br />
dn: cn=Tai Tran,ou=network,dc=abc,dc=com<br />
objectclass: inetOrgPerson<br />
cn: Tai Tran<br />
cn: Tai Tran Tuan<br />
sn: Tai<br />
uid: taitt<br />
userpassword: 123456<br />
mail: taitt@abc.com<br />
mail: taitt@saigontech.edu.vn<br />
ou: network<br />
<br />
dn: cn=Nam Le,ou=network,dc=abc,dc=com<br />
objectclass: inetOrgPerson<br />
cn: Nam Le<br />
cn: Nam Le Quoc<br />
sn: Nam<br />
uid: namlq<br />
userpassword: 123456<br />
mail: namlq@abc.com<br />
mail: namlq@saigontech.edu.vn<br />
ou: network<br />
....</p>
<p>
Best Regards,<br />
</p>
<pre>--
***********************************
EVERYTHING HAS JUST BEGUN...</pre>