Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The LDAP server is hosted on Solaris. The client is CentOS. OpenLDAP/NSLCD/SSH authentication via LDAP work fine, but I am not able to use the ldapsearch commands to debug LDAP issues.

[root@tst-01 ~]# ldapsearch
SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
        additional info: SASL(-4): no mechanism available:
[root@tst-01 ~]# cat /etc/openldap/ldap.conf
TLS_CACERTDIR /etc/openldap/cacerts
URI ldap://ldap1.tst.domain.tld ldap://ldap2.tst.domain.tld
BASE dc=tst,dc=domain,dc=tld
[root@tst-01 ~]# ls -al /etc/openldap/cacerts
total 12
drwxr-xr-x. 2 root root 4096 Jun  6 10:31 .
drwxr-xr-x. 3 root root 4096 Jun 10 10:12 ..
-rw-r--r--. 1 root root  895 Jun  6 10:01 cacert.pem
lrwxrwxrwx. 1 root root   10 Jun  6 10:31 cf848aa4.0 -> cacert.pem
[root@tst-01 ~]#

I have tried authentication with a certificate via ldapsearch giving /etc/openldap/cacerts/cacert.pem as a parameter, but it didn't accept this certificate for authentication.

share|improve this question

1 Answer 1

up vote 6 down vote accepted

You may wish to turn off SASL and use simple authentication with the "-x" option. For example, a search to find a particular user

ldapsearch -x -D "uid=search-user,ou=People,dc=example,dc=com" \
           -W -H ldap://ldap.example.com -b "ou=People,dc=example,dc=com" \
           -s sub 'uid=test-user'

Will find "test-user" by

  • -D - Use bind user "search-user"
  • -W - Prompt for password
  • -H - URL of LDAP server. Non-SSL in this case; use "ldaps://" for SSL
  • -b - The search base
  • -s - Search scope - i.e. base for base of tree, one for on level down and sub for recursively searching down the tree (can take a while)
  • Finally the search filter as a non-option argument. In this case we will search for the uid of "test-user"
share|improve this answer
1  
Fred has it right, except that you don't need to specify the search base or host if you are happy with the ones specified in /etc/openldap/ldap.conf i.e. the following should probably work: ldapsearch -x -D "<bind dn>" -W <query> –  Jason Tan Jun 11 '13 at 18:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.