I've been working on migrating an existing server cluster to using openldap for user/password management. I've run into a problem though - I do not have access to plain text passwords and all SASL methods (that I've identified so far) require plaintext passwords in the database. The only format available is crypt. Period.
For many programs, simple authentication is still available. However if one uses libldap2 (openldap) specifically ldap_sasl_interactive_bind family of functions only supports SASL connections, all others are disabled and deprecated.
So how do I authenticate, if SASL is broken? (SASL not supporting crypt = broken)
Authentication approaches to be used:
radius (freeradius)
web
custom C apps
ssh
ldap mirroring
I've been able to get radius to work, and that is all.
Help very much welcome - the docs don't say why simple auth has been deprecated and it seems to be the only one that can work. Any time SASL is engaged nothing works.
Environment is ubuntu-14.04; openldap, cyrus-sasl (through openldap), freeradius, apache, and custom C and C++ components.