I am trying to authenticate subversion users against sasl+ldap. Other questions about this problem seem to be related to earlier versions of subversion, or sasldb authentication.
lsb_release -a No LSB modules are available. Distributor ID: Debian Description: Debian GNU/Linux 8.1 (jessie) Release: 8.1 Codename: jessie svnserve --version svnserve, version 1.8.10 (r1615264) Cyrus SASL authentication is available. saslauthd -v saslauthd 2.1.26 authentication mechanisms: sasldb getpwent kerberos5 pam rimap shadow ldap
The sasl+LDAP part seems to be correctly configured:
testsaslauthd -u user -p password -r realm 0: OK "Success."
Testing it with wrong credentials gives an error:
testsaslauthd -u wronguser -p wrongpassword -r wrongrealm 0: NO "authentication failed"
And it shows an error in auth.log:
Sep 10 22:23:53 xxx saslauthd: Entry not found ((&(objectClass=posixAccount)(uid=wronguser))). Sep 10 22:23:53 xxx saslauthd: Authentication failed for wronguser/wrongrealm: User not found (-6) Sep 10 22:23:53 xxx saslauthd: do_auth : auth failure: [user=wronguser] [service=imap] [realm=wrongrealm] [mech=ldap] [reason=Unknown]
So I assume SASL can contact the LDAP server fine and get the data.
I configured subversion with:
/etc/sasl2/svn.conf: pwcheck_method: saslauthd mech_list: DIGEST-MD5
checking svnserve with strace -e open shows that it opens this file, and not /usr/lib/sasl2 or similar.
When I try to connect from a svn client I get
Sep 10 22:31:38 xxx svnserve: DIGEST-MD5 common mech free
in auth.log for each try, but no info or errors from saslauthd.
If I add the user account to sasldb2:
saslpasswd2 user -u realm Password: password
I can connect from the svn client correctly. So it looks like sasl uses the sasldb2, even though the config for svn and for saslauthd configures LDAP.