11 reputation
1
bio website
location Los Angeles, CA
age
visits member for 1 year, 5 months
seen Jan 9 at 3:51

Jan
1
awarded  Teacher
Dec
13
comment OSX 10.7 Directory Utility - Editing OpenLDAP
Thank you @Rich, I appreciate the response. After further research, I determined that the Mac was attempting to use CRAM-MD5 as a SASL auth mechanism, but the Linux OpenLDAP was using Kerberos. So, if I took out the GSSAPI password and assigned a plain text password, it worked, and I was able to authenticate and edit using Directory Utility. Clearly, this is far from ideal from a security perspective.
Nov
12
comment OSX 10.7 Directory Utility - Editing OpenLDAP
Hey @Matt, I think I've got it. Turns out that DU was attempting to authenticate over SASL using a CRAM-MD5 scheme instead of GSSAPI. So, several things had to change. I had to add an olcAuthzRegexp to allow for CRAM-MD5, had to make sure my olcAccess allowed write to * for my admin user, and had to store that admin user's password in LDAP as cleartext. I know this isn't ideal, but I would get the dreaded "No secret in database" error. Has anyone successfully gotten DU to authenticate using GSSAPI instead of CRAM-MD5?
Nov
8
comment OpenLDAP Authentication in Mixed Enviroment
The OP asked how to authenticate using Apple's Directory Utility, which I am still struggling with. DU attempts to do a SASL bind. From the error logs, I'm still trying to determine which mechanism is used. Any advice would be appreciated.
Oct
21
comment OSX 10.7 Directory Utility - Editing OpenLDAP
Hi Matt, thanks for the tip. All of the Linux tools work just fine, and I'm able to connect with both an unencrypted connection and a TLS-encrypted one. Looking at the server logs, it looks like DU is attempting to use SASL, so I'm trying to get that to work. In addition, I need to verify that the admin user has all of the necessary access to modify entries in the DB.
Oct
21
comment OSX 10.7 Directory Utility - Editing OpenLDAP
Using good, old-fashioned command line ldapsearch, everything works fine. However, I haven't yet tried with JXplorer, I'll give that a shot. Thanks! It would appear that Directory Utility is attempting to connect using SASL, which I am trying to get running at the moment.
Oct
18
asked OSX 10.7 Directory Utility - Editing OpenLDAP
Oct
18
answered OpenLDAP Authentication in Mixed Enviroment
Oct
9
comment ldapsearch password file format
In followup to grawity's comment, echo -n works perfectly, e.g.: echo -n "secretpassword" > /etc/ldapscripts/ldapscripts.passwd
Jun
5
answered How to set file/folder permissions using Rsync from Windows to Linux