Subject: Cyrus -> LDAP Authentication

From: "Gavin Young" <[email-masked]>
Date: Thu, 16 Dec 2004 11:49:10 +1300

Hopefully someone here can help me...

Has anyone else set-up a Postfix + Cyrus mail server authentication against OpenLDAP using saslauthd?

I'm really struggling so any help including links to existing documents would be very useful. My main concern at the moment is getting Cyrus IMAP to authenticate against LDAP. I have been told to use saslauthd but any easier suggestions would be welcomed. Sorry for the long post but I'm trying not to miss anything.

I am using Fedora Core 2 on the test box but it will be RHEL3 when in production. My postifix+cyrus install works correctly with local accounts using the setup below:

/etc/sysconfig/saslauthd
SOCKETDIR=/var/run/saslauthd
#MECH=shadow --default FC3, couldn't get cyradm to work
MECH=pam
FLAGS=

/etc/imapd.conf
configdirectory: /var/lib/imap
partition-default: /var/spool/imap
admins: cyrus
sievedir: /var/lib/imap/sieve
sendmail: /usr/sbin/sendmail
hashimapspool: true
sasl_pwcheck_method: saslauthd
sasl_mech_list: PLAIN
tls_cert_file: /usr/share/ssl/certs/cyrus-imapd.pem
tls_key_file: /usr/share/ssl/certs/cyrus-imapd.pem
tls_ca_file: /usr/share/ssl/certs/ca-bundle.crt

/etc/openldap/ldap.conf
HOST localhost
BASE dc=example,dc=org

/etc/ldap.conf
host 127.0.0.1
base dc=example,dc=org
ssl no
pam_password md5

To try an get Cyrus to authenticate against LDAP these are the steps I have taken:

1) Install saslauthd
--cyrus-sasl-2.1.18-2.2 (+devel & md5) RPMS are installed

2) Choose ldap as auth mechanism if supported
--ldap seems supported, saslauthd -v outputs:
saslauthd 2.1.18
authentication mechanisms: getpwent kerberos5 pam rimap shadow ldap
--changed /etc/sysconfig/saslauthd config file to:
SOCKETDIR=/var/run/saslauthd
#MECH=shadow --default FC3, couldn't get cyradm to work
#MECH=pam
MECH=ldap
FLAGS=

3) Edit ldap.conf so that it fits your ldap server
--no changes, defaults ok??

4) Edit imap.conf so auth method = saslauthd
--no change required, already set to saslauthd
--restarted cyrus-imapd and saslauthd

When testing with "testsaslauthd -u john -p password" or "testsaslauthd -u [email-masked] -p password" testauthd returns: 0: NO "authentication failed"

When testing with "./imtest -a john localhost" and ""./imtest -a [email-masked] localhost" login fails. Log output:

/var/log/maillog
badlogin: localhost.localdomain [127.0.0.1] plaintext john SASL(-13):
authentication failure: checkpass failed

/var/log/messages
saslauthd[6142]: do_auth : auth failure: [user=john] [service=imap] [realm=] [mech=ldap] [reason=Unknown]

Reading the saslauthd ldap documentation
( <http://www.irbs.net/internet/info-cyrus/0207/att-0599/LDAP_SASLAUTHD>) it explains how to define ldap servers etc but when I place this in /etc/sysconfig/saslauthd and restart saslauthd I get "line x: ldap_servers:: command not found". Should this info be placed somewhere else?

HELP!
1) Are there are any other log files I should be watching for hints?
2) Have I missed a config file somewhere?
3) Am I testing correctly?
3) Do I need to define more than just the base in /etc/ldap.conf (ie username field = uid and the password field = userPassword?

Any help would be greatly appreciated.

Regards,
Gavin