Ubuntu’s openldap SASL authentication mechanism
In preparation for the possibility of new users at civilfritz, I’ve been
trying to set up openldap on slice1. 10.10 uses a cn=config tree to
configure openldap, which I don’t have any experience with. That’s fine,
but I have found it particularly difficult to find documentation about.
I eventually found OpenLDAP’s documentation on
cn=config,
and eventually understood that the ldif literally stored on the disk
serves to define the configuration tree.
That left me still wondering how Ubuntu intends you to authenticate to
the directory. It turns out that Ubuntu sets up an EXTERNAL
authentication mechanism, and I found examples of its
use.
Update:
It’s getting so much clearer now! I knew I wanted to learn about sasl.
It turns out that dn’s of the form
uid=<username>,cn=<mechanism>,cn=auth or
uid=<username>,cn=<realm>,cn=<mechanism>,cn=auth represent virtual
identities that don’t actually exist in the directory. You usually set
up a mapping between these virtual identities and entities stored in the
directory, but the default ACL permits access explicitly to
gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth. I can’t
find explicit documentation about ldapi and
cn=peercred,cn=external,cn=auth yet, but it appears that, when I do,
it will basically just describe the virtual identity tree as an
interface to access a user’s unix identity via an IPC socket.
Another update:
While it’s true that the ldif stored at /etc/ldap/slapd.d is the literal
backend storage for the cn=config hierarchy, you’re not meant to modify
it directly (because, for example, the server stores things that you
might not specify, like a structuralObjectClass attribute). Once I
figured out how to modify the directory as root,
(sudo ldap${foo} -Y EXTERNAL -H ldapi:///) everything made sense.