I am trying to configure SASL running on Centos 6.5 to allow authentication towards the corporate active directory server. The end goal is to authenticate access to some subversion repos which are running on this server, but at this stage I am just trying to get saslauthd to authenticate, and testing it using testsaslauthd.
Authentication fails every time with the following in the log:
saslauthd :do_auth : auth failure: [user=MYUSER] [service=svn] [realm=MYREALM] [mech=ldap] [reason=Unknown] saslauthd :do_request : response: NO
This is my /etc/saslauthd.conf:
ldap_auth_method: bind ldap_servers: ldaps://ldap.ad.mycompany.com:3269/ ldap_bind_dn: MYBINDDN ldap_password: xxxxxxxxxx ldap_search_base: DC=mycompany,DC=xx ldap_filter: (&(cn=%u)(objectClass=person)) ldap_referrals: yes log_level: 10
Note that I know the ldap server URI, bind DN, password, search base and filter are correct because I have a perl script which uses these to perform authentication for a web site and it works fine. The perl script uses Net::LDAP, binds to the AD, searches for the user using the search base and filter, then attempts to bind using the user's DN and password. As I understand it this is exactly what SASL should be trying to do the way I have configured it.
My first observation is that despite having set log_level to 10, I get only one line telling me it failed with reason unknown. I am starting saslauthd from the shell with the -d (debug) option. What else can I do to get more debugging output?
Is there any way to get the LDAP interaction to be logged?
Finally, can anyone see anything wrong with my configuration? Perhaps some AD quirks that require special settings in the SASL configuration?