>
> How do I verify that the NS1 crypt is correct outside of the solaris
> client (or ldap_gen_profile)?
Don't know... I've only ever seen {NS1} with Solaris' LDAP client.
Anyone know more about this hash, and what other tools can work with it?
> The password in FDS for the above proxy user is stored in CRYPT format
> in FDS- is this mismatch really supported ?
Yes. The NS1 hash is really just to obscure the password in the
ldap_client_cred file. When doing a simple bind, it is reversed and
transmitted as clear text.
> suggestions?
Try putting the password cleartext directly in your ldap_client_cred
file. Maybe there was a typo when generating the NS1 hash?
e.g.:
NS_LDAP_BINDPASSWD= the-password
Then restart Solaris' ldapclient.
Doug Chapman wrote:
> I'm looking for troubleshooting advice- hope someone has some insight
> I can borrow.
>
> Trying to get a Solaris8 client (with the latest ldap patchcluster) to
> do simple authentication against FDS.
> When setup for anonymous auth, I'm able to do ldap list just fine:
>
> # ldaplist -l passwd tester
> dn: cn=test user,ou=People,dc=corp,dc=example,dc=com
> givenName: test
> sn: user
> loginShell: /bin/bash
> gidNumber: 1024
> uidNumber: 5351
> mail: tester at example.com
> objectClass: person
> objectClass: organizationalPerson
> objectClass: inetOrgPerson
> objectClass: posixAccount
> objectClass: top
> uid: tester
> gecos: test user
> cn: test user
> homeDirectory: /nethome/tester
>
>
> When setup for simple auth (and that's all I've changed), I'm seeing
> error 49 (invalid credentials) in the FDS logs:
>
> [10/Aug/2007:14:45:02 -0700] conn=25532 fd=65 slot=65 connection from
> 172.20.100.85 to 172.20.200.125
> [10/Aug/2007:14:45:02 -0700] conn=25532 op=0 BIND
> dn="cn=sunldap,ou=profile,dc=corp,dc=example,dc=com" method=128
> version=3
> [10/Aug/2007:14:45:02 -0700] conn=25532 op=0 RESULT err=49 tag=97
> nentries=0 etime=0
> [10/Aug/2007:14:45:02 -0700] conn=25532 op=1 UNBIND
> [10/Aug/2007:14:45:02 -0700] conn=25532 op=1 fd=65 closed - U1
>
> Here's my /var/ldap/ldap_client_cred file
> NS_LDAP_BINDDN= cn=sunldap,ou=profile,dc=corp,dc=example,dc=com
> NS_LDAP_BINDPASSWD= {NS1}8cf5886bf25241a5a5045e
>
> How do I verify that the NS1 crypt is correct outside of the solaris
> client (or ldap_gen_profile)?
>
> The password in FDS for the above proxy user is stored in CRYPT format
> in FDS- is this mismatch really supported ?
>
> I can bind with the 'sunldap' user just fine from my linux hosts using
> ldapsearch.
>
> suggestions?
>
