2

I am able to log in to an Active Directory using the userPrincipalName attribute of a user objectClass; (e.g. foo@mydomain.com)

I have also set up an OpenLDAP server instance to which I can only authenticate using the dn, e.g.

"cn=somecn,cn=anothercn,ou=someou,dc=mydomain,dc=com"

How is it possible to authenticate to OpenLDAP using another field, e.g. the mail attribute of the inetOrgPerson for example?

What is more, even if such thing were possible, how would anyone ensure uniqueness of the field? (a functionality I assume is offered by AD in terms of the userPrincipalName field)

  • Are you writing an application of some sort that authenticates users against LDAP, or trying to configure a particular OS to allow logins using the mail attribute? If so, what OS exactly? (assumedly something *nix-ish) – Alexios Jun 19 '18 at 8:12
  • It is an application that will auth users against the ldap but I was wondering whether that application is able to perform login directly via another unique kind of attribute (other than that I think it is feasible for the app to make us of ldapsearch of some kind to map e.g. mails to DNs) – pkaramol Jun 19 '18 at 8:31
5

OpenLDAP supports two authentication methods (simple and SASL), while SASL is the default method for ldap-utils like ldapsearch.

When you are authenticating using the DN, you do a so called "simple bind".

simple bind

The simple method has three modes of operation:

  • anonymous
  • unauthenticated
  • user/password authenticated

For example:

# ldapwhoami -x
anonymous

or:

# ldapwhoami -x -D uid=rda,ou=people,dc=phys,dc=ethz,dc=ch -w secret1234
dn:uid=rda,ou=people,dc=phys,dc=ethz,dc=ch

SASL

OpenLDAP clients and servers are capable of authenticating via the Simple Authentication and Security Layer (SASL) framework, which is detailed in RFC4422. SASL supports several authentication mechanisms. The most common mechanisms with OpenLDAP are EXTERNAL and GSSAPI.

The EXTERNAL mechanism makes use of an authentication performed by a lower-level protocol: usually TLS or Unix IPC. For example using Unix IPC as user root:

# ldapwhoami -Y EXTERNAL -H ldapi://
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn:gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

The authenitcated user is mapped to a DN in the tree cn=peercred,cn=external,cn=auth.

The GSSAPI mechanism usually means Kerveros 5. If you have a Kerberos 5 infrastructure deployed you can use Kerberos Principals for authentication.

First authenticate against the KDC and get a TGT:

# kinit rda
Password for rda@PHYS.ETHZ.CH: secret1234

Then you can use GSSAPI for authentication against OpenLDAP:

# ldapwhoami
SASL/GSSAPI authentication started
SASL username: rda@PHYS.ETHZ.CH
SASL SSF: 56
SASL data security layer installed.
dn:uid=rda,cn=gssapi,cn=auth

The principal rda@PHYS.ETHZ.CH is mapped to a DN in the tree cn=gssapi,cn=auth.

Now you can map that authenticated DN to an actual DN in the database using a regular expression with the olcAuthzRegexp configuration in cn=config:

dn: cn=config
objectClass: olcGlobal
cn: config
olcAuthzRegexp: {0}uid=([^,/]*),cn=phys.ethz.ch,cn=gssapi,cn=auth uid=$1,ou=people,dc=phys,dc=ethz,dc=ch
...

This olcAuthzRegexp line maps any user principal in the realm PHYS.ETHZ.CH to a corresponding posixAccount entry under ou=people,dc=phys,dc=ethz,dc=ch which has the same username in the uid attribute.

For example with the following posix entry

# ldapsearch uid=rda
dn: uid=rda,ou=people,dc=phys,dc=ethz,dc=ch
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: krbPrincipalAux
objectClass: krbTicketPolicyAux
uid: rda
krbPrincipalName: rda@PHYS.ETHZ.CH
...

ldapwhoami will show:

# ldapwhoami
SASL/GSSAPI authentication started
SASL username: rda@PHYS.ETHZ.CH
SASL SSF: 56
SASL data security layer installed.
dn:uid=rda,ou=people,dc=phys,dc=ethz,dc=ch

The mapping using olcAuthzRegexp must match a unique entry in the DIT. This is to be ensured by the administrator or the managing software.

  • You could possible use the rwm module to map from an email address to a DN, but I have never tried that. See man 5 slapo-rwm. – rda Jun 18 '18 at 20:34
  • many thanx for this well elaborated solution; – pkaramol Jun 20 '18 at 9:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.