CentOS - Jan 2006 - OpenLDAP Problem

Everyone,

We currently are running a Centos3 directory server, I am currently 
testing centos4 as an upgrade of this machine in the future. There is a 
special user we have called cn=samba,ou=special in our directory, this 
user is for samba to use when binding to the directory. On the 
production replica server, i have taken an offline slapcat ldif of the 
entire tree. I then copied this file to the test centos4 machine running 
ldap with the same configuration as the centos3 production server. I did 
a slapadd of this ldif file, then fixed some minor import errors as a 
result. The problem occurs now when we try to bind to the test machine, 
with ldapsearch or smbd, as this special samba user, ldap comes back and 
tells me the credentials are incorrect. From what i understand about the 
userPassword attribute is that it is outputted by slapcat as a base64 
encoded MD5 hash.  I have compared the hashes between the production 
server and the test server, and they are both identical. I can however 
do all this successfully with the admin user. I am lost as to the cause 
of this error.


Thanks

Peter

On Mon, 2006-01-09 at 17:15 +1100, Peter Kitchener
wrote:
> Everyone,
> 
> We currently are running a Centos3 directory server, I am currently 
> testing centos4 as an upgrade of this machine in the future. There is a 
> special user we have called cn=samba,ou=special in our directory, this 
> user is for samba to use when binding to the directory. On the 
> production replica server, i have taken an offline slapcat ldif of the 
> entire tree. I then copied this file to the test centos4 machine running 
> ldap with the same configuration as the centos3 production server. I did 
> a slapadd of this ldif file, then fixed some minor import errors as a 
> result. The problem occurs now when we try to bind to the test machine, 
> with ldapsearch or smbd, as this special samba user, ldap comes back and 
> tells me the credentials are incorrect. From what i understand about the 
> userPassword attribute is that it is outputted by slapcat as a base64 
> encoded MD5 hash.  I have compared the hashes between the production 
> server and the test server, and they are both identical. I can however 
> do all this successfully with the admin user. I am lost as to the cause 
> of this error.
----
simplify this to make it easier...

# ldapsearch -x -h localhost -D 'uid=test2,ou=People,dc=azapple,dc=com'
-W '(uid=test2)'
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <> with scope sub
# filter: (uid=test2)
# requesting: ALL
#

# test2, People, azapple.com
dn: uid=test2,ou=People,dc=azapple,dc=com
sambaNTPassword: 7C273E51DE2020E0BBC2C2B70CAB7B45
sambaLMPassword: AA9C761F0E1E2E7FAAD3B435B51404EE
givenName: Test2
sn: User
sambaProfilePath: \\srv1\profiles\test2
sambaLogonScript: logon.bat
etc...

bind from the command line using ldapsearch

In theory, your understanding is correct. In practice, it may not be
entirely correct since it may not be MD5 encryption - it depends on your
slapd.conf and the mechanics of how that password was put there for the
user.

The easiest thing to do is to set the password from the command line but
it would have to be a real posix user...

# passwd test2
Changing password for user test2.
New UNIX password:
BAD PASSWORD: it is too short
Retype new UNIX password:
LDAP password information changed for test2
passwd: all authentication tokens updated successfully.

then I ***know*** that openldap is happy with the password.

Craig