Virtual domain problem - POP/IMAP, SASL & LDAP

Julian W H Osborne josborne at imsmaxims.com
Tue Mar 15 13:00:27 EST 2005


Igor Brezac wrote:
> 
> On Tue, 15 Mar 2005, Julian W H Osborne wrote:
> 
>> Dear All,
>>
>> I'm having some problems getting Cyrus imap to work correctly with 
>> sasl and ldap.  Using the testsaslauthd command all is okay, username 
>> and domain
>> is passed through.  However, when using the imap or pop client only 
>> the user part of the login name is passed through, e.g. if username is
>> test at imsmaxims.com only test is being passed through.  I've pasted 
>> everything I think is useful.
>>
>> System details are:
>>
>> Linux localhost.localdomain 2.6.10-1.770_FC2 #1 Sat Feb 26 21:40:22 
>> EST 2005 i686 i686 i386 GNU/Linux
>> Fedora Core release 2 (Tettnang)
>> cyrus-imapd-2.2.10-3.fc2
>> cyrus-sasl-2.1.18-2.2
>>
>>
>> Thanks
>>
>> Julian
>>
>>
>> testsaslauthd
>> =============
>>
>> testsaslauthd -u test at imsmaxims.com -p password
>> 0: OK "Success."
>>
>> Mar 15 16:37:17 localhost slapd[3234]: conn=18 op=3 BIND anonymous 
>> mech=implicit ssf=0
>> Mar 15 16:37:17 localhost slapd[3234]: conn=18 op=3 BIND 
>> dn="cn=manager,o=virtual_domain" method=128
>> Mar 15 16:37:17 localhost slapd[3234]: conn=18 op=3 BIND 
>> dn="cn=Manager,o=virtual_domain" mech=SIMPLE ssf=0
>> Mar 15 16:37:17 localhost slapd[3234]: conn=18 op=3 RESULT tag=97 
>> err=0 text=
>> Mar 15 16:37:17 localhost slapd[3234]: conn=18 op=4 SRCH 
>> base="o=virtual_domain" scope=2 filter="(uid=test at imsmaxims.com)"
>> Mar 15 16:37:17 localhost slapd[3234]: conn=18 op=4 SRCH attr=dn
>> Mar 15 16:37:17 localhost slapd[3234]: conn=18 op=4 SEARCH RESULT 
>> tag=101 err=0 nentries=1 text=
>> Mar 15 16:37:17 localhost slapd[3234]: conn=18 op=5 BIND anonymous 
>> mech=implicit ssf=0
>> Mar 15 16:37:17 localhost slapd[3234]: conn=18 op=5 BIND 
>> dn="uid=test at imsmaxims.com,ou=it-dept,ou=uk,ou=imsmaxims.com,o=virtual_domain" 
>> method=128
>> Mar 15 16:37:17 localhost slapd[3234]: conn=18 op=5 BIND 
>> dn="uid=test at imsmaxims.com,ou=it-dept,ou=uk,ou=imsmaxims.com,o=virtual_domain" 
>> mech=SIMPLE ssf=0
>> Mar 15 16:37:17 localhost slapd[3234]: conn=18 op=5 RESULT tag=97 
>> err=0 text=
>>
>>
>> IMAP Connection
>> ===============
>> telnet localhost 143
>> Trying 127.0.0.1...
>> Connected to localhost.
>> Escape character is '^]'.
>> * OK IMAP
>> . login test at imsmaxims.com password
>> . NO Login failed: authentication failure
>> . logout
>> * BYE LOGOUT received
>> . OK Completed
>> Connection closed by foreign host.
>>
>> Mar 15 16:38:45 localhost slapd[3234]: conn=19 op=3 BIND anonymous 
>> mech=implicit ssf=0
>> Mar 15 16:38:45 localhost slapd[3234]: conn=19 op=3 BIND 
>> dn="cn=manager,o=virtual_domain" method=128
>> Mar 15 16:38:45 localhost slapd[3234]: conn=19 op=3 BIND 
>> dn="cn=Manager,o=virtual_domain" mech=SIMPLE ssf=0
>> Mar 15 16:38:45 localhost slapd[3234]: conn=19 op=3 RESULT tag=97 
>> err=0 text=
>> Mar 15 16:38:45 localhost slapd[3234]: conn=19 op=4 SRCH 
>> base="o=virtual_domain" scope=2 filter="(uid=test)"
>> Mar 15 16:38:45 localhost slapd[3234]: conn=19 op=4 SRCH attr=dn
>> Mar 15 16:38:45 localhost slapd[3234]: conn=19 op=4 SEARCH RESULT 
>> tag=101 err=0 nentries=0 text=
>>
>> imapd.conf (/etc/)
>> ==================
>>
>> # SASL Features
>> sasl_maximum_layer:             256
>> sasl_minimum_layer:             0
>> sasl_pwcheck_method:            saslauthd
>> sasl_mech_list:                 PLAIN
>>
>> # Virtual Domain Support
>> # Default domain
>> defaultdomain:                  imsmaxims.com
>>
>> # Toggle virtual domains or or off
>> # tried both userid and yes and on
>> virtdomains:                    userid
>>
>> saslauthd.conf (/etc/)
>> ======================
>> ldap_servers:   ldap://127.0.0.1/
>> ldap_bind_dn:   cn=manager, o=virtual_domain
>> ldap_bind_pw:   secret
>> ldap_search_base: o=virtual_domain
>> ldap_version:   3
>> ldap_filter:    (uid=%u) --------> have tried %U@%d also
> 
> 
> Use the following params:
> 
> ldap_default_domain: imsmaxims.com
> ldap_filter: %U@%d

Made those changes and got:

Mar 15 18:00:06 localhost slapd[3234]: conn=29 fd=8 ACCEPT from 
IP=127.0.0.1:32845 (IP=0.0.0.0:389)
Mar 15 18:00:06 localhost slapd[3234]: conn=29 op=0 BIND 
dn="cn=manager,o=virtual_domain" method=128
Mar 15 18:00:06 localhost slapd[3234]: conn=29 op=0 BIND 
dn="cn=Manager,o=virtual_domain" mech=SIMPLE ssf=0
Mar 15 18:00:06 localhost slapd[3234]: conn=29 op=0 RESULT tag=97 err=0 
text=
Mar 15 18:00:06 localhost slapd[3234]: conn=29 op=1 SRCH 
base="o=virtual_domain" scope=2 filter="(uid=test at localdomain)"
Mar 15 18:00:06 localhost slapd[3234]: conn=29 op=1 SRCH attr=dn
Mar 15 18:00:06 localhost slapd[3234]: conn=29 op=1 SEARCH RESULT 
tag=101 err=0 nentries=0 text=

> 
> cyrus-imapd will drop the domain part if it is the same as 
> defaultdomain. In addition, libsasl will pass fully qualified userids as 
> two separate tokens (user and domain) to saslauthd.  So, %u will always 
> be just user without the domain part.  You can pass -r to saslauthd for 
> the userid reassembly, but you will still have problems with 
> defaultdomain logins. The above changes to saslauthd.conf should work 
> for you.
> 
> -Igor
> 
> 
>> ldap_scope:     sub
>>
>> Cyrus.conf (/usr/lib/sasl2/)
>> ============================
>> pwcheck_method:saslauthd
>>
>>
>>
> 


-- 

====================================================================
Julian W H Osborne
IMS MAXIMS Plc
Sandymount, Station Road, Woburn Sands, MK17 8RR, UK
Tel: +44 (0)1908 588800 Fax: +44 (0)1908 588819

Clara House, Glenageary Park, Glenageary, Dublin, Ireland
Tel: +353 (0)1 2840555 Fax: +353 (0)1 2840829

http://www.imsmaxims.com/
====================================================================
---
Cyrus Home Page: http://asg.web.cmu.edu/cyrus
Cyrus Wiki/FAQ: http://cyruswiki.andrew.cmu.edu
List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html




More information about the Info-cyrus mailing list