{"id":21275873,"url":"https://github.com/tannevaled/slapd-contrib","last_synced_at":"2026-02-11T16:32:39.318Z","repository":{"id":144482977,"uuid":"85820347","full_name":"tannevaled/slapd-contrib","owner":"tannevaled","description":null,"archived":false,"fork":false,"pushed_at":"2017-04-24T09:51:34.000Z","size":9,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-22T03:29:07.023Z","etag":null,"topics":["gssapi","kerberos","openldap","passthru","plain","sasl","saslauthd","simple-bind"],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tannevaled.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-03-22T11:34:17.000Z","updated_at":"2023-09-08T17:22:36.000Z","dependencies_parsed_at":null,"dependency_job_id":"9d11b589-2a9c-4728-bd3e-5a09d7e90c03","html_url":"https://github.com/tannevaled/slapd-contrib","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tannevaled%2Fslapd-contrib","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tannevaled%2Fslapd-contrib/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tannevaled%2Fslapd-contrib/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tannevaled%2Fslapd-contrib/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tannevaled","download_url":"https://codeload.github.com/tannevaled/slapd-contrib/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243732303,"owners_count":20338839,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["gssapi","kerberos","openldap","passthru","plain","sasl","saslauthd","simple-bind"],"created_at":"2024-11-21T09:39:25.632Z","updated_at":"2026-02-11T16:32:34.289Z","avatar_url":"https://github.com/tannevaled.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# slapd-contrib\n\nThe purpose is to be able to bind simple to the LDAP directory while having the userPassword stored in Kerberos\n\n## Kerberos\n### Installation\n### Configuration\n```\n[libdefaults]\n    default_realm = \u003cOU\u003e.\u003cDOMAIN\u003e.\u003cTLD\u003e\n    dns_lookup_realm = false\n    dns_lookup_kdc = false\n    ticket_lifetime = 24h\n    forwardable = true\n    udp_preference_limit = 1000000\n#    default_tkt_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1\n#    default_tgs_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1\n#    permitted_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1\n\n[realms]\n    \u003cOU\u003e.\u003cDOMAIN\u003e.\u003cTLD\u003e = {\n        kdc            = kdc.\u003cou\u003e.\u003cdomain\u003e.\u003ctld\u003e:88\n        admin_server   = kdm.\u003cou\u003e.\u003cdomain\u003e.\u003ctld\u003e:749\n        default_domain = \u003cou\u003e.\u003cdomain\u003e.\u003ctld\u003e\n    }\n\n[domain_realm]\n    .\u003cou\u003e.\u003cdomain\u003e.\u003ctld\u003e = \u003cOU\u003e.\u003cDOMAIN\u003e.\u003cTLD\u003e\n     \u003cou\u003e.\u003cdomain\u003e.\u003ctld\u003e = \u003cOU\u003e.\u003cDOMAIN\u003e.\u003cTLD\u003e\n\n[logging]\n    kdc          = FILE:/var/log/krb5kdc.log\n    admin_server = FILE:/var/log/kadmin.log\n    default      = FILE:/var/log/krb5lib.log\n```\n## PAM\n### Configuration\n#### /etc/pam.d/ldap \n```\n#%PAM-1.0\nauth       include      password-auth\naccount    include      password-auth\n```\n## OpenLDAP\n### Installation\n#### \n```\nmake base\nmake init\nmake conf\n```\n### Configuration\n#### /etc/nslcd.conf\n```\nuri ldap://ldap1.\u003cou\u003e.\u003cdomain\u003e.\u003ctld\u003e ldap://ldap2.\u003cou\u003e.\u003cdomain\u003e.\u003ctld\u003e\nbase dc=\u003cou\u003e,dc=\u003cdomain\u003e,dc=\u003ctld\u003e\n```\n#### /etc/openldap/ldap.conf\n```\n\nURI\t          ldaps://ldap1.\u003cou\u003e.\u003cdomain\u003e.\u003ctld\u003e ldaps://ldap2.\u003cou\u003e.\u003cdomain\u003e.\u003ctld\u003e\nBASE\t      dc=\u003cou\u003e,dc=\u003cdomain\u003e,dc=\u003ctld\u003e\nTLS_CACERTDIR /etc/openldap/certs\nTLS_REQCERT   demand\nSASL_MECH     PLAIN\n# Turning this off breaks GSSAPI used with krb5 when rdns = false\nSASL_NOCANON\ton\n```\n#### /etc/openldap/slapd.conf\n```\nsecurity ssf=1 update_ssf=112 simple_bind=64\n\n# to get administration rights when authenticated with SASL/GSSAPI\nauthz-regexp \"^uid=([^/,]*)/admin,cn=\u003cou\u003e.\u003cdomain\u003e.\u003ctld\u003e,cn=GSSAPI,cn=auth\" \"cn=admin,dc=\u003cou\u003e,dc=\u003cdomain\u003e,dc=\u003ctld\u003e\"\n\n# to get administration rights when authenticated with SASL/PLAIN\nauthz-regexp \"^uid=([^/,]*),cn=plain,cn=auth\" \"uid=$1,ou=users,dc=\u003cou\u003e,dc=\u003cdomain\u003e,dc=\u003ctld\u003e\"\n\naccess to *\n        by dn.exact=\"gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth\" manage\n        by dn.exact=\"cn=admin,dc=\u003cou\u003e,dc=\u003cdomain\u003e,dc=\u003ctld\u003e\" manage\n        by * none\n```\n### user.ldif\nUsing the {SASL} prefix in the userPassword attribute let us use simple-bind for compatibility purpose.\n\ncf http://www.lichteblau.com/ldapvi/cyrus-sasl/sysadmin.html\nRealms will be passed to saslauthd as part of the saslauthd protocol, however the way each saslauthd module deals with the situation is different (for example, the LDAP plugin allows you to use the realm to query the server, while the rimap and PAM plugins ignore it entirely).\n\ncf https://web.mit.edu/kerberos/krb5-1.5/krb5-1.5.4/doc/krb5-user/What-is-a-Kerberos-Principal_003f.html\nTraditionally, a principal is divided into three parts: the primary, the instance, and the realm. The format of a typical Kerberos V5 principal is primary/instance@REALM. \n\n```\ndn: uid=\u003cuid\u003e,ou=users,ou=\u003cou\u003e,dc=\u003cdomain\u003e,dc=\u003ctld\u003e\nuid: \u003cuid\u003e\nuserPassword: {SASL}\u003cprimary\u003e\n```\n## SASL\n### Installation\n### Configuration\n#### /etc/sysconfig/saslauthd\n```\n# Directory in which to place saslauthd's listening socket, pid file, and so\n# on.  This directory must already exist.\nSOCKETDIR=/run/saslauthd\n\n# Mechanism to use when checking passwords.  Run \"saslauthd -v\" to get a list\n# of which mechanism your installation was compiled with the ablity to use.\nMECH=pam\n\n# Additional flags to pass to saslauthd on the command line.  See saslauthd(8)\n# for the list of accepted flags.\n#FLAGS=\"-O /etc/saslauthd.conf\"\n```\n#### /etc/sasl2/slapd.conf\n```\nmech_list: PLAIN\npwcheck_method: saslauthd\nsaslauthd_path: /run/saslauthd/mux\n```\n### \n```\n# systemctl enable saslauthd\n# systemctl start  saslauthd\n```\n## Tests\n### saslauthd authentication mechanisms\n```\n# saslauthd -v\nsaslauthd 2.1.26\nauthentication mechanisms: getpwent kerberos5 pam rimap shadow ldap httpform\n```\n### slapd supported SASL Mechanisms\n```\n# ldapsearch -x -H ldapi:/// -b '' -LLL -s base supportedSASLMechanisms\ndn:\nsupportedSASLMechanisms: GSS-SPNEGO\nsupportedSASLMechanisms: GSSAPI\nsupportedSASLMechanisms: EXTERNAL\nsupportedSASLMechanisms: LOGIN\nsupportedSASLMechanisms: PLAIN\n```\n### SASL / GSSAPI\n```\n# kinit \u003cuid\u003e@LABOS.\u003cDOMAIN\u003e.\u003cTLD\u003e\nPassword for \u003cuid\u003e@LABOS.\u003cDOMAIN\u003e.\u003cTLD\u003e:\n# ldapvi -Z -Y GSSAPI\nSASL/GSSAPI authentication started\nSASL username: \u003cuid\u003e@LABOS.\u003cDOMAIN\u003e.\u003cTLD\u003e\nSASL SSF: 56\nSASL data security layer installed.\n    162 entries read                                                                                                                                                                                                     \nNo changes.\n```\n### SASL / PLAIN\n```\n# ldapvi -Z -Y PLAIN -U \u003cuid\u003e\nSASL/PLAIN authentication started\n\n--- SASL login\nType M-h for help on key bindings.\n\n authorization name: \nauthentication name: \u003cuid\u003e\n           password: **********\nSASL username: \u003cuid\u003e\nSASL SSF: 0\n      162 entries read                                                                                                                                                                                                     \nNo changes.\n```\n### SASL / SIMPLE-BIND PASSTHRU\n```\n# ldapvi -Z -D uid=\u003cuid\u003e,ou=users,ou=\u003cou\u003e,dc=\u003cdomain\u003e,dc=\u003ctld\u003e\n\n--- Login\nType M-h for help on key bindings.\n\nFilter or DN: uid=\u003cuid\u003e,ou=users,ou=\u003cou\u003e,dc=\u003cdomain\u003e,dc=\u003ctld\u003e\n    Password: **********\n    162 entries read                                                                                                                                                                                                     \nNo changes.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftannevaled%2Fslapd-contrib","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftannevaled%2Fslapd-contrib","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftannevaled%2Fslapd-contrib/lists"}