SASL LDAP + TLS

[David E. Wheeler]

Howdy,

I'm trying to get SASL working with OpenLDAP + TLS. I got it working  
without TLS with these settings:

slapd.conf:
----------
TLSCipherSuite HIGH:MEDIUM:+SSLv2
TLSCACertificateFile /etc/ssl/certs/cacert.pem
TLSCertificateFile /etc/ssl/certs/servercert.pem
TLSCertificateKeyFile /etc/ssl/private/serverkey.pem
TLSVerifyClient allow

sasl-regexp
     uid=(.*),cn=digest-md5,cn=auth
     uid=$1,ou=people,dc=kineticode,dc=com

saslauthd.conf:
--------------
ldap_servers: ldap://localhost/
ldap_use_sasl: yes

This works great with testsaslauthd:

% sudo testsaslauthd -u david -p '******'
0: OK "Success."

However, when I add these lines to saslauthd.conf, it fails:

ldap_start_tls: yes
ldap_tls_cacert_file: /etc/ssl/certs/cacert.pem
ldap_tls_cert: /etc/ssl/certs/clientcert.pem
ldap_tls_key: /etc/ssl/certs/clientkey.pem

Here's the test:

% sudo testsaslauthd -u david -p '******'
0: NO "authentication failed"

Here's what shows up in the auth.log:

Mar 19 13:11:48 sahlins sudo:    david : TTY=pts/0 ; PWD=/home/david ;  
USER=root ; COMMAND=/usr/sbin/testsaslauthd -u david -p *******
Mar 19 13:11:48 sahlins saslauthd[8258]: start tls failed (Connect  
error).
Mar 19 13:11:48 sahlins saslauthd[8258]: Authentication failed for  
david: Cannot connect to ldap server (configuration error) (-8)
Mar 19 13:11:48 sahlins saslauthd[8258]: do_auth         : auth  
failure: [user=david] [service=imap] [realm=] [mech=ldap]  
[reason=Unknown]

For some reason startls fails. However, when I create ~/.ldaprc with  
these lines:

TLS_CERT        /etc/ssl/certs/clientcert.pem
TLS_KEY         /etc/ssl/certs/clientkey.pem
SASL_MECH       EXTERNAL

Then I can successfully auth using ldapsearch:

% ldapsearch -U david -v '(&(objectClass=inetLocalMailRecipient) 
(uid=david))' -ZZ
ldap_initialize( <DEFAULT> )
SASL/EXTERNAL authentication started
SASL username: CN=*.kineticode.com,OU=Kineticode,O=Kineticode\2C  
Inc.,ST=Oregon,C=US
SASL SSF: 0
filter: (&(objectClass=inetLocalMailRecipient)(uid=david))
requesting: All userApplication attributes
# extended LDIF
#
# LDAPv3
# base <> with scope subtree
# filter: (&(objectClass=inetLocalMailRecipient)(uid=david))
# requesting: ALL
#

# david, people, kineticode.com
dn: uid=david,ou=people,dc=kineticode,dc=com
<snip/>
# search result
search: 3
result: 0 Success

So please, can anyone tell me what I'm missing? From the docs I gather  
that I have to have a client certificate and key for sasl external to  
use (and I assume that external is what testsaslauthd does), so I  
created the cert and key and it seems to work with ldapsearch (without  
even requiring a password!) but not testsaslauthd. :-(

FWIW, where I'm going with this is supporting Postfix SMTP Auth, which  
uses SASL.

Thanks,

David