| Summary: | ns-slapd segfaults when attempting to authenticate with pam_passthru-plugin through pam_ldap | ||
|---|---|---|---|
| Product: | [Retired] 389 | Reporter: | Steven Seed <Steven.Seed> |
| Component: | Directory Server | Assignee: | Rich Megginson <rmeggins> |
| Status: | CLOSED WONTFIX | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 1.2.8 | CC: | edewata, nhosoi, nkinder, rmeggins |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-02-14 16:32:28 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Steven Seed
2011-02-14 06:17:07 UTC
I don't think this will work on el5. The problem is that 389-ds-base on el5 uses mozldap but pam_ldap uses openldap - as you can see in the stack trace above the ldap functions use some from libldap-2.3 and some from libldap60 - these two different ldap libraries are not binary compatible and many problems such as crashes will ensue. I suppose you could try regular (not PAM) pass through authentication http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html-single/Administration_Guide/index.html#Using_the_Pass_through_Authentication_Plug_in or chaining backend/database links http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html-single/Administration_Guide/index.html#Configuring_Directory_Databases-Creating_and_Maintaining_Database_Links On Fedora 14 and later, and on EL6 and later, 389 is able to use openldap instead of mozldap I've tried the regular pass through, but my bind dn's do not match on each ldap server. I need a way to map one bind dn to another. If you could help me with that I wouldn't need to use pam. I was originally going to use EL6 for the 389 directory, but it appears there is still no stable packages for EL6 in EPEL or koji. Using chaining might work for me, but It a bit complicated. I can't exactly wrap my head around it. What I'm trying to do is this... I have one directory running 389-ds which has no password values in the entries so binding as a user is not possible. I want to be able to authenticate access to this directory using a pass through mechanism to another ldap directory so that I can put the 389-ds directory out on a DMZ for address book queries without exposing my sensitive data stored in an internal directory (Red Hat DS 8.2). (In reply to comment #2) > I've tried the regular pass through, but my bind dn's do not match on each ldap > server. I need a way to map one bind dn to another. If you could help me with > that I wouldn't need to use pam. I was originally going to use EL6 for the 389 > directory, but it appears there is still no stable packages for EL6 in EPEL or > koji. Using chaining might work for me, but It a bit complicated. I can't > exactly wrap my head around it. What I'm trying to do is this... 389-ds-base will be going into RHEL6, probably RHEL6.1. Since it will be part of RHEL, it cannot be in EPEL. > > I have one directory running 389-ds which has no password values in the entries > so binding as a user is not possible. I want to be able to authenticate access > to this directory using a pass through mechanism to another ldap directory so > that I can put the 389-ds directory out on a DMZ for address book queries > without exposing my sensitive data stored in an internal directory (Red Hat DS > 8.2). It will be complicated, but you can use replication and chain on update + chain on bind requests: http://directory.fedoraproject.org/wiki/Howto:ChainOnUpdate The host in the DMZ would be a read only replica - use Fractional Replication to only replicate those attributes you want to expose to address book clients. Set up the read only replica to chain BIND requests back to the master. Thanks. I was able to set up a database link to chain the authentication. |