0

I am attempting to get Macs, running os 10.7.5 Lion, to authenticate using OpenLDAP running on Ubuntu 12.0.4 LTS. One of the things that I would love to be able to do is to use Apple's lovely Directory Utility client to physically edit entries on the LDAP server. I have set up my Root DN as cn=admin,dc=example,dc=com. However, I am unable to authenticate using the DU client to edit the entries stored in the LDAP. I tried using "admin" as a username, and "cn=admin,dc=example,dc=com" as well. Has anyone gotten this to work?

Improve this question
2
  • First, have you verified that the same credentials work with a different editor? You could try JXplorer on the Mac.
    – LaC
    Oct 19, 2013 at 18:57
  • Using good, old-fashioned command line ldapsearch, everything works fine. However, I haven't yet tried with JXplorer, I'll give that a shot. Thanks! It would appear that Directory Utility is attempting to connect using SASL, which I am trying to get running at the moment.
    – Ned W.
    Oct 21, 2013 at 17:44

2 Answers 2

Reset to default
0

OS X Server uses OpenLDAP as it's LDAP server so the DU utility should be able to administer it. Without more information, we can't really troubleshoot this problem. Most importantly can you administer the LDAP server with Linux tools with the credentials you specified? If not see this guide on how to set the OpenLDAP http://www.howtoforge.com/linux_openldap_setup_server_client

Improve this answer
2
  • Hi Matt, thanks for the tip. All of the Linux tools work just fine, and I'm able to connect with both an unencrypted connection and a TLS-encrypted one. Looking at the server logs, it looks like DU is attempting to use SASL, so I'm trying to get that to work. In addition, I need to verify that the admin user has all of the necessary access to modify entries in the DB.
    – Ned W.
    Oct 21, 2013 at 18:06
  • Hey @Matt, I think I've got it. Turns out that DU was attempting to authenticate over SASL using a CRAM-MD5 scheme instead of GSSAPI. So, several things had to change. I had to add an olcAuthzRegexp to allow for CRAM-MD5, had to make sure my olcAccess allowed write to * for my admin user, and had to store that admin user's password in LDAP as cleartext. I know this isn't ideal, but I would get the dreaded "No secret in database" error. Has anyone successfully gotten DU to authenticate using GSSAPI instead of CRAM-MD5?
    – Ned W.
    Nov 12, 2013 at 0:21
0

One of the services our IT team occasionally provides is connecting Mac desktops up to our Linux-hosted OpenLDAP server using a simple anonymous bind. Our OpenLDAP server doesn’t have any schema support built in for OS X, but historically we’ve gotten around that by using the RFC 2307 template support built into the LDAPv3 directory service plug-in. When we started deploying Lion, we hit a number of issues with using Directory Utility by itself to connect to OpenLDAP.

A lot of the problem was centered around the fact that Lion’s LDAP plug-in is now attempting to use the best SASL authentication method advertised by the LDAP server. Even if the server doesn’t require authentication, the Mac’s LDAP plug-in will still try to authenticate. What you’ll wind up with is an LDAP bind that allows lookups, but does not allow LDAP accounts to log in.

Most of the fixes I was able to find online involved going into the GUI and making some changes, then opening the relevant plist and making some more changes. Others recommended setting up the bind on one machine and then copying the relevant files from machine to machine.

As part of making OpenLDAP work with our Macs running Lion and later, I wrote a script to automate the bind process and made it available here on GitHub. It was originally written to handle 10.6.x and 10.7.x, but I've been testing it with new OS releases and I've verified that it works (in my shop) for 10.6.x through 10.9.x.

The details on my findings are available here.

Improve this answer
1
  • Thank you @Rich, I appreciate the response. After further research, I determined that the Mac was attempting to use CRAM-MD5 as a SASL auth mechanism, but the Linux OpenLDAP was using Kerberos. So, if I took out the GSSAPI password and assigned a plain text password, it worked, and I was able to authenticate and edit using Directory Utility. Clearly, this is far from ideal from a security perspective.
    – Ned W.
    Dec 13, 2013 at 0:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .