Red Hat DIRECTORY SERVER 8.0, Administration Manual

Page: 384 / 552

Chapter 12. Managing SASL
366
CRAM-MD5
,
DIGEST-MD5
, and
GSS-API
are
shared secret
mechanisms. The server challenges the
client attempting to bind with a
secret
, such as a password, that depends on the mechanism. The user
sends back the response required by the mechanism.
NOTE
DIGEST-MD5
requires clear text passwords. The Directory Server requires the clear text
password in order to generate the shared secret. Passwords already stored as a hashed
value, such as
SHA1
cannot
be used with
DIGEST-MD5
.
12.2. SASL Identity Mapping
When processing a SASL bind request, the server matches, or maps, the SASL authentication
ID used to authenticate to the Directory Server with an LDAP entry stored within the server.
When using Kerberos, the SASL user ID usually has the format
userid@REALM
, such as
scarter@EXAMPLE.COM
. This ID must be converted into the DN of the user's Directory Server entry,
such as
uid=scarter,ou=people,dc=example,dc=com
.
If the authentication ID clearly corresponds to the LDAP entry for a person, it is possible to configure
the Directory Server to map the authentication ID automatically to the entry DN. Directory Server
has some preconfigured default maps which handle most common configurations, and customized
maps can be created. During a bind attempt, the first matching mapping rule is applied. If only one
user identity is returned, the bind is successful; if none or more than one are returned, then the bind
fails. Red Hat recommends configuring SASL maps so that only one mapping rule matches the
authentication string.
NOTE
SASL proxy authorization is not supported in Directory Server; therefore, Directory Server
ignores any SASL
authzid
value supplied by the client.
SASL is configured by entries under a container entry:
dn: cn=sasl,cn=config
objectClass: top
objectClass: nsContainer
cn: sasl
SASL identity mapping entries are children of this entry:
dn: cn=mapping,cn=sasl,cn=config
objectClass: top
objectClass: nsContainer
cn: mapping
Mapping entries contain three attributes,
nsSaslMapRegexString
,
nsSaslMapBaseDNTemplate
,
and
nsSaslMapFilterTemplate
. The
nsSaslMapping
object class sets these identity mapping
parameters.
The
nsSaslMapRegexString
attribute sets variables of the form
\1
,
\2
,
\3
, as in the example,
for bind IDs which are filled into the template attributes during a search. For example, this sets up
nsSaslMapping
: