> On 14 Apr 2020, at 05:22, Kyle Brantley <kyle@xxxxxxxxxxxxxx> wrote: > > Log here, but it’s not really any more illuminating: https://paste.centos.org/view/raw/ec0588a0 > And filtered down to just lines that contain ‘sasl’: https://paste.centos.org/view/raw/ea345620 > > From what I can tell, the first time the SASL identity is shown in any form, the realm is absent. Timestamp of my “ldapwhois” is 13:04:52. Timestamp of me changing the logging back to 0 is 13:05:42. > >>>> >>>> - SASL mapping: >>>> nsSaslMapRegexString: \(.*\)@\(.*\)\.\(.*\) >>>> nsSaslMapFilterTemplate: (cn=\1) >>>> nsSaslMapBaseDNTemplate: ou=accounts,dc=app,dc=averageurl,dc=com >>>> >>>> - Alternative SASL mapping that I'd prefer to use: >>>> nsSaslMapRegexString: \(.*\)@AVERAGEURL\.COM >>>> nsSaslMapFilterTemplate: (cn=\1) >>>> nsSaslMapBaseDNTemplate: ou=accounts,dc=app,dc=averageurl,dc=com >>>> Hi there, The SASL mappings that are provided by default make a lot of assumptions, and honestly, I don't really like them :) 1: remove all sasl maps that exist under cn=mapping,cn=sasl,cn=config 2: Create your map as: cn=krb,cn=mapping,cn=sasl,dc=config cn: krb nsSaslMapRegexString: \(.*\) nsSaslMapBaseDNTemplate: ou=account,dc=.... nsSaslMapFilterTemplate: (uid=\1) 3: restart your instance 4: check if that works :) According to my notes, there is a bug in sasl where with gssapi/krb it doesn't pass the realm through correctly, so your map needs to omit it. — Sincerely, William Brown Senior Software Engineer, 389 Directory Server SUSE Labs _______________________________________________ 389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
