LDAP authentication client issue


 
Thread Tools Search this Thread
Operating Systems AIX LDAP authentication client issue
# 1  
Old 05-18-2013
LDAP authentication client issue

Hi,

I am trying to authenticate AIX server against a IDS LDAP instance.

The AIX version is 6.1 and TDS client is 6.1.

I configured the secldapclntd using ldap.cfg file and changed /etc/security/user to set SYSTEM=LDAP, registry=LDAP for one user. Below are the ldap.cfg configurations -

Code:
ldapservers:xx.xx.xx.xx
binddn:cn=test
bindpwd:test
authtype:ldap_auth
useSSL:no
userattrmappath:/etc/security/ldap/2307aixuser.map
groupattrmappath:/etc/security/ldap/2307aixgroup.map
userbasedn:ou=People,ou=server1,ou=all_servers,o=test.com
groupbasedn:ou=Groups,ou=server1,ou=all_servers,o=test.com
userclasses:posixaccount,account,shadowaccount,aixauxaccount,ibm-securityIdentities
groupclasses:posixgroup,aixauxgroup
ldapport:489
cachetimeout: 0 
searchmode:ALL
defaultentrylocation:LDAP
serverschematype:rfc2307aix

Now when I start the secldapclntd daemon, I can see search and modify queries on the LDAP server audit logs. But no bind requests are coming from the client and the authentication fails and user gets "Access denied" message.

What is the reason that bind requests are not coming to server ? I have enabled audit log for all operations even for success cases.

Please help. Thanks in advance !

---------- Post updated at 11:52 AM ---------- Previous update was at 11:49 AM ----------

ldap.cfg file configurations with spaces to avoid smileys -

Code:
ldapservers:xx.xx.xx.xx
binddn:cn=test
bindpwd:test
authtype:ldap_auth
useSSL:no
userattrmappath:/etc/security/ldap/2307aixuser.map
groupattrmappath:/etc/security/ldap/2307aixgroup.map
userbasedn : ou=People,ou=server1,ou=all_servers,o=test.com
groupbasedn : ou=Groups,ou=server1,ou=all_servers,o=test.com
userclasses : posixaccount,account,shadowaccount,aixauxaccount,ibm-securityIdentities
groupclasses : posixgroup,aixauxgroup
ldapport:489
cachetimeout: 0
searchmode:ALL
defaultentrylocation:LDAP
serverschematype:rfc2307aix

Moderator's Comments:
Mod Comment Please use code tags. You can also "avoid using smilies" by using the Go Advanced button and checking the "Disable smilies in text" box in the Miscellaneous Options section.

Last edited by Scott; 05-18-2013 at 01:36 PM.. Reason: Code tags...
# 2  
Old 05-18-2013
I will have to check my notes, but I think it is caused by the authtype:ldap_auth option you are choosing. I recall having some issues with that.

Have you tried using a command like:
Code:
LDAP_SERVER=somehost
PWD=myPassword
...
mksecldap -c -h ${LDAP_SERVER} -a cn=aixtools -p ${PWD} -d cn=aixadmin

I do not have my test installation up at the moment, so I cannot check the authtype setting when using mksecldap command.

Hope this helps!
# 3  
Old 05-19-2013
Thanks Michael, but if you see my ldap.cfg settings, I have already set it as ldap_auth.

I have it working on AIX 5.3, but does not work on 6.1 Smilie

One more factor - the IDS server was already installed on my client unix server and has an instance running on it (which is used by another application). But for authentication, I point the unix server to a different instance on a different system.

Another small difference noticed - the IDS server filesets already installed in the server show level 6.2.0.16 (when used command lslpp -l), however the 32 bit client used by secldapclntd was missing. So I downloaded 6.2 IDS installer and installed the 32 bit client which shows level 6.2.0.0 (on command lslpp -l). Do you think this difference could matter ?

I do not want to change the existing IDS server filesets and also cannot find 32 bit client fix pack version 6.2.0.16

Please suggest !
# 4  
Old 05-19-2013
Quote:
Originally Posted by vs1
Thanks Michael, but if you see my ldap.cfg settings, I have already set it as ldap_auth.
And that is the error - I fear - see below. unix_auth is default
Quote:
I have it working on AIX 5.3, but does not work on 6.1 Smilie

One more factor - the IDS server was already installed on my client unix server and has an instance running on it (which is used by another application). But for authentication, I point the unix server to a different instance on a different system.

Do you think this difference could matter ?
As one server can have multiple instances running, and the AIX client is designed to make queries from multiple DIT domains, each of which could be a different server, or the same server - I see no issues.
Quote:
I do not want to change the existing IDS server filesets and also cannot find 32 bit client fix pack version 6.2.0.16

Please suggest !
The only reason it "could" matter is if there is a bug. Initially, the 6.2 base was on the AIX 6.1 expansion disk - it is the default for AIX 7.1 (with 6.3 on the AIX 7.1 expansion disk) - until 6.3 becomes the default.

I did not pay that much attention to the versioning of LDAP the last years, but my understanding is that the servers support at their level and back level clients. So, again, except for a hard bug - I do not see any reason for an auth failure - other that what I ran into when experimenting with unix_auth and ldap_auth for the authtype setting.

ISS-ITDS-AIX 6.2.0 fixes
I tried the link above from two different browsers and they both seemed to work. This is a Fixcentral 'thing' so you may need to register before you can actually access the downloads.

Hope this helps!

From: AIX InfoCenter aixfiles:LDAP.CFG
Quote:
autheyhtype Specifies the authentication mechanism to use. Valid values are unix_auth and ldap_auth. The default is unix_auth.
  • unix_auth - Retrieves the user password from LDAP and authenticate the user locally.
  • ldap_auth - Binds to the LDAP server as the authenticating user in order to authenticate. Note: Password will be sent in clear text to the LDAP server for ldap_auth authentication mechanism. Use of SSL is strongly encouraged.
I understand this to mean all password verification is done at the ldap server when using ldap_auth as authtype. Note also, the default is unix_auth (only the "hash" aka "encrypted" string is retrieved).
Using db2ldif -I instanceName (often the userid - hint) -o instance.ldif you should be able to examine what the LDAP server has stored.

In short, as a start, I would switch to unix_auth and see if you can start connecting as expected. Note: you may need to change the password before all the password encryption is "as expected" by AIX.

Hope this helps!
# 5  
Old 05-19-2013
I changed the authtype to ldap_auth, restarted the secldapclntd, and ran command ls-secldapclntd to make sure that auth type is ldap_auth.

However, I am still not able to authenticate successfully. On the server side, the data imported in the LDAP instance is same data exported using sectoldif from the client system.

In the server audit log, I saw bind request only once for the user after restarting. Is there any way that I can debug secldapclntd on the client machine and see what requests it is sending ? I want to enable logging the AIX auth sub-system (requests from auth to LAM to secldapclntd to LDAP server) to find where the error is.

Does anyone know how to enable audit logging on the client side?
# 6  
Old 05-20-2013
change the authtype to "unix_auth" - that is the default.

After you do that, and restart the daemon, do a pwdadm/passwd command to reset the password value stored on the ldap server
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

LDAP Client not connecting to LDAP server

I have very limited knowledge on LDAP configuration and have been trying fix one issue, but unsuccessful. The server, I am working on, is Solaris-10 zone. sudoers is configured on LDAP (its not on local server). I have access to login directly on server with root, but somehow sudo is not working... (9 Replies)
Discussion started by: solaris_1977
9 Replies

2. AIX

LDAP authentication

Hi, We are trying to use LDAP to authenticate the login from our application. Our application is installed on AIX 6.1 and LDAP server is on active directory windows 2003. We are getting the below error when we try to login. We have the required lib file in the path it is looking for. Any idea... (3 Replies)
Discussion started by: Nand1010_MA
3 Replies

3. Solaris

Authentication with LDAP in opensolaris

Hi all, I have two virtual machines, one with Suse and another with opensolaris 2009.06. The ldap server is in the Suse machine. From my opensolaris, with command ldalist i can see the information about the ldap configuration, i mean, the dn: ou:.... if i type id <ldapuser> i can see the user... (0 Replies)
Discussion started by: checoturco
0 Replies

4. UNIX for Advanced & Expert Users

LDAP client issue

Hello, I'm new to Centos and to openldap. I am by trade a Solaris Admin. I'm experimenting with openldap and thought Linux would be easier to install and setup openldap on, so far this is true. The problem I'm having is that I can't get the client server to authenticate to the openldap server. I... (1 Reply)
Discussion started by: bitlord
1 Replies

5. AIX

LDAP user authentication issue

Hello everyone, hoping you can provide some incite with a little problem I'm having.. I have the LDAP client configured and running on my AIX 5.3 server, which is authenticating against an eDirectory LDAP server. I can login via LDAP no problems on the AIX server with newly created users,... (4 Replies)
Discussion started by: j_aix
4 Replies

6. Solaris

LDAP authentication

Hi folks, i have opends 1.2 manually installed subversion 1.4.3 and apache2 updated by package manager. i want to access svn using LDAP authentication its giving an error: ldap_simple_bind_s() failed. what could be the problem. i wrote some text at the end of httpd.conf fpr ldap... (2 Replies)
Discussion started by: visu_buri
2 Replies

7. Red Hat

CVS ldap authentication

I am trying to convert all my redhat servers over to ldap. I have solved almost all the probems but am having trouble getting cvs pserver to authenticate. I'm running redhat 4. Just patched everything the other day. cvs is cvs-1.11.17-9.1.el4_7.1. Any suggestions would be welcome. Obviously... (1 Reply)
Discussion started by: jhtrice
1 Replies

8. Cybersecurity

LDAP authentication question

Hello, I have a Linux box with RHEL4 running on it. The box is meant to be on the DMZ. There is a directory on the box that will be remotely from time to time and I want a form of authentication on it. Presently, I have configured Basic authentication with apache but the security is not tight. I... (1 Reply)
Discussion started by: bptronics
1 Replies

9. Linux

LDAP authentication question

Hello, I have a Linux box with RHEL4 running on it. The box is meant to be on the DMZ. There is a directory on the box that will be remotely from time to time and I want a form of authentication on it. Presently, I have configured Basic authentication with apache but the security is not tight. I... (1 Reply)
Discussion started by: bptronics
1 Replies

10. Shell Programming and Scripting

Module for LDAP Authentication

Hello Everyone, I have enabled LDAP authentication on my Web script by adding the list of valid users in /etc/apach2/default-server.conf. However, I now want to retrieve the username of the person that logs in. How can I do that? Is there any such module? Regards, Harsha (0 Replies)
Discussion started by: garric
0 Replies
Login or Register to Ask a Question