Thanks !
Removing the special characters from my password caused it to start
working- I guess using dollar signs for your proxy account isn't
supported (bug in solaris client?)
On 8/10/07, George Holbert <gholbert@xxxxxxxxxxxx> wrote:
> >
> > How do I verify that the NS1 crypt is correct outside of the solaris
> > client (or ldap_gen_profile)?
>
> Don't know... I've only ever seen {NS1} with Solaris' LDAP client.
> Anyone know more about this hash, and what other tools can work with it?
>
> > The password in FDS for the above proxy user is stored in CRYPT format
> > in FDS- is this mismatch really supported ?
>
> Yes. The NS1 hash is really just to obscure the password in the
> ldap_client_cred file. When doing a simple bind, it is reversed and
> transmitted as clear text.
>
>
> > suggestions?
>
> Try putting the password cleartext directly in your ldap_client_cred
> file. Maybe there was a typo when generating the NS1 hash?
>
> e.g.:
>
> NS_LDAP_BINDPASSWD= the-password
>
>
> Then restart Solaris' ldapclient.
>
>
>
>
> Doug Chapman wrote:
> > I'm looking for troubleshooting advice- hope someone has some insight
> > I can borrow.
> >
> > Trying to get a Solaris8 client (with the latest ldap patchcluster) to
> > do simple authentication against FDS.
> > When setup for anonymous auth, I'm able to do ldap list just fine:
> >
> > # ldaplist -l passwd tester
> > dn: cn=test user,ou=People,dc=corp,dc=example,dc=com
> > givenName: test
> > sn: user
> > loginShell: /bin/bash
> > gidNumber: 1024
> > uidNumber: 5351
> > mail: tester@xxxxxxxxxxx
> > objectClass: person
> > objectClass: organizationalPerson
> > objectClass: inetOrgPerson
> > objectClass: posixAccount
> > objectClass: top
> > uid: tester
> > gecos: test user
> > cn: test user
> > homeDirectory: /nethome/tester
> >
> >
> > When setup for simple auth (and that's all I've changed), I'm seeing
> > error 49 (invalid credentials) in the FDS logs:
> >
> > [10/Aug/2007:14:45:02 -0700] conn=25532 fd=65 slot=65 connection from
> > 172.20.100.85 to 172.20.200.125
> > [10/Aug/2007:14:45:02 -0700] conn=25532 op=0 BIND
> > dn="cn=sunldap,ou=profile,dc=corp,dc=example,dc=com" method=128
> > version=3
> > [10/Aug/2007:14:45:02 -0700] conn=25532 op=0 RESULT err=49 tag=97
> > nentries=0 etime=0
> > [10/Aug/2007:14:45:02 -0700] conn=25532 op=1 UNBIND
> > [10/Aug/2007:14:45:02 -0700] conn=25532 op=1 fd=65 closed - U1
> >
> > Here's my /var/ldap/ldap_client_cred file
> > NS_LDAP_BINDDN= cn=sunldap,ou=profile,dc=corp,dc=example,dc=com
> > NS_LDAP_BINDPASSWD= {NS1}8cf5886bf25241a5a5045e
> >
> > How do I verify that the NS1 crypt is correct outside of the solaris
> > client (or ldap_gen_profile)?
> >
> > The password in FDS for the above proxy user is stored in CRYPT format
> > in FDS- is this mismatch really supported ?
> >
> > I can bind with the 'sunldap' user just fine from my linux hosts using
> > ldapsearch.
> >
> > suggestions?
> >
>
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
--
Fedora-directory-users mailing list
Fedora-directory-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users
