I've been working on migrating an existing server cluster to using openldap for user/password management. I've run into a problem though - I do not have access to plain text passwords and all SASL methods (that I've identified so far) require plaintext passwords in the database. The only format available is crypt. Period.

For many programs, simple authentication is still available. However if one uses libldap2 (openldap) specifically ldap_sasl_interactive_bind family of functions only supports SASL connections, all others are disabled and deprecated.

So how do I authenticate, if SASL is broken? (SASL not supporting crypt = broken)

Authentication approaches to be used: radius (freeradius)
custom C apps
ldap mirroring

I've been able to get radius to work, and that is all.

Help very much welcome - the docs don't say why simple auth has been deprecated and it seems to be the only one that can work. Any time SASL is engaged nothing works.

Environment is ubuntu-14.04; openldap, cyrus-sasl (through openldap), freeradius, apache, and custom C and C++ components.

  • for custom apps, ldap_sasl_bind_s( ... LDAP_SASL_SIMPLE ..) works too it seems. I'm still having problems with pam, but it might be unrelated, or related possibly to an error with migrationtools. – Teunis Peters Oct 1 '15 at 20:23

There isn't much difference between LDAP simple authentication and SASL/PLAIN. In both, the plaintext password is provided by the client and processed by the server. OpenLDAP does not require passwords to be stored in plaintext, and, in fact, can use the local system's crypt(3) function. Because you are dealing with plaintext passwords during transmit, effort should be taken to ensure that those passwords aren't sent in the clear. This is usually done by using STARTTLS as part of the LDAP connection, but LDAPS is also an option.

$ ldapwhoami -h ldap.example.com -ZZ -x -D uid=user,ou=people,dc=example,dc=com -W
Enter LDAP Password:
$ ldapwhoami -h ldap.example.com -ZZ -D uid=user,ou=people,dc=example,dc=com -W
Enter LDAP Password: 
  • useful for other readers. I'm using SSL or STARTTLS, depending on client. And again, I can't get any SASL authentication to actually function, although LDAP_SASL_SIMPLE works from a c client. ok ldapwhoami specifically : requires a -D uid=x... and works if and only if that's provided. Since I'd been assuming it worked like whoami and didn't require that ... that's my error. I'm still having problem with crypt, but slowly narrowing them down to SASL vs (my failure to read unclear documentation) – Teunis Peters Oct 2 '15 at 23:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.