OpenLDAP authentication

[hobleyd]

Hello,

I have a predominantly Windows/Linux network running here, and we have recently purchased 3 Mac laptops which also need integration to the network. I would like to enable logins with those Macs via the (Zimbra) OpenLDAP server we have running. I have this working for the Linux machines via pam_ldap but I am having a little more trouble with the Macs.

I have used Directory Access to specify an LDAPv3 server and configured it to use the RFC 2307 (Unix) mappings. If I run a lookupd -d from the terminal, I can query for my username and see the LDAP entry returned, so communications with the LDAP is working:

> userWithName: user
Dictionary: “DS: user user”
_lookup_agent: DSAgent
_lookup_validation: 1193700085
gid: 1024
home: /home/directory
name: username fullname
passwd: {SSHA}big passwd hash {SSHA}the same password hash
realname: fullname
shell: /bin/bash
uid: 1024
+ Category: user
+ Time to live: 43200
+ Age: 0 (expires in 43200 seconds)
+ Negative: No
+ Cache hits: 0
+ Retain count: 5

When I try and log in however, the login window vibrates and refuses to let me in.

Zimbra hashes the password in the LDAP tree with SSHA. Setting the DirectoryService to debug, shows a bunch of output, but nothing to indicate it is trying to use SSHA. The relevant debug output is here:

2007-10-29 16:31:46 EST – CLDAPv3Plugin: DoAuthenticationOnRecordType – Attempting use of authentication method dsAuthMethodStandard:dsAuthNodeNativeCanUseClearText
2007-10-29 16:31:46 EST – CLDAPv3Plugin: LookupAttribute error -14131
2007-10-29 16:31:46 EST – CLDAPv3Plugin: DoBasicAuth::
2007-10-29 16:31:46 EST – CLDAPv3Plugin: DoBasicAuth – Attempting use of authentication method dsAuthMethodStandard:dsAuthNodeNativeCanUseClearText
2007-10-29 16:31:46 EST – CLDAPv3Plugin: Attempting Crypt Authentication
2007-10-29 16:31:46 EST – CLDAPv3Plugin: Attempting Cleartext Authentication
2007-10-29 16:31:46 EST – CLDAPNode: EstablishConnection – Previous replica with IP Address = X.X.X.X responded for read
2007-10-29 16:31:46 EST – CLDAPNode: EstablishConnection – Using replica with IP Address = X.X.X.X for read
2007-10-29 16:31:46 EST – CLDAPNode: Attempting GSSAPI Authentication
2007-10-29 16:31:46 EST – CLDAPNode: Error getting TGT for user line 444 in PlugIns/LDAPv3/CLDAPNode.cpp
2007-10-29 16:31:46 EST – CLDAPNode: Couldn’t get Kerberos credentials for GSSAPI
2007-10-29 16:31:46 EST – CLDAPNode: Failed GSSAPI Authentication for dn:uid=,ou=people,dc=MY,dc=DOMAIN
2007-10-29 16:31:46 EST – CLDAPNode: Attempting CRAM-MD5 Authentication
2007-10-29 16:31:46 EST – CLDAPNode: Node Authentication failed

Can anyone shed any light on this?

Cheers,
David

[hobleyd]

Thanks for the suggestions; given Zimbra is not something I wanted to mess with too greatly, I thought I would see if Leopard fixed the problems – and indeed – it now appears to work.

So I assume that 10.4. doesn’t support SSHA salted passwords, but that 10.5 does.

Cheers,
David

[Author]

Posts