I have a linux (4.1.12-61.1.34.el6uek.x86_64) box with a slapd service (slapd 2.4.40). What I'm trying to achieve is to transparently proxy all client ldap related traffic through this slapd instance to an Active Directory server. The reason I need to do this is that the traffic needs to be tunneled via TLS 1.2 and my client application does not support it. Unfortunaltely I don't have control over the client, it's a given.
The client needs to authenticate against the AD using a username and pwd provided by a user. And then obtain the list of groups this user belongs to, fairly straightforward.
The server requires simple bind with a bind user and plain text password. When I attempt to query the AD server through the slapd instance I always get below error (when running
slapd -f slapd.conf -d 4 -d 16 -d 32)
send_ldap_result: err=49 matched="" text=""
Which essentially means that authentication fails. When I bypass my slapd proxy and use ldapsearch to connect to the AD directly everything works flawlessly.
ldapsearch via slapd (gives error):
ldapsearch -H ldap://localhost -x -D cn=user,ou=bind,dc=domain,dc=com -W -s sub "(cn=VNA-*)" -v
ldapsearch direct (no error, returns results from AD):
ldapsearch -H ldaps://ad.domain.com:636 -x -D cn=user,ou=bind,dc=domain,dc=com -W -s sub "(cn=VNA-*)" -v
I have tried playing with all of the various options mainly in idassert-bind, but none seem to make any difference. I would appreciate any help in getting this to work.
include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/inetorgperson.schema # Global options loglevel 256 sizelimit unlimited idletimeout 3600 writetimeout 600 pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args allow bind_v2 # Modules modulepath /usr/lib/openldap modulepath /usr/lib64/openldap moduleload back_ldap TLSCACertificateFile /etc/openldap/cacerts/cacert.pem database ldap readonly yes uri "ldaps://ad.domain.com:636" suffix "dc=domain,dc=com" idassert-bind bindmethod=simple mode=self binddn="cn=user,ou=bind,dc=domain,dc=com" credentials=secret tls_reqcert=never tls_cacert=/etc/openldap/cacerts/cacert.pem idassert-authzFrom "*"