Red Hat DIRECTORY SERVER 8.0, Administration Manual

Page: 385 / 552

Configuring SASL Identity Mapping from the Console
367
dn: cn=mymap,cn=mapping,cn=sasl,cn=config
objectclass:top
objectclass:nsSaslMapping
cn: mymap
nsSaslMapRegexString: \(.*\)@\(.*\)\.\(.*\)
nsSaslFilterTemplate: (objectclass=inetOrgPerson)
nsSaslBaseDNTemplate: uid=\1,ou=people,dc=\2,dc=\3
When a Directory Server receives a SASL bind request with
mconnors@EXAMPLE.COM
as the user ID (
authid
), the regular expression would fill in the base DN template with
uid=mconnors,ou=people,dc=EXAMPLE,dc=COM
as the user ID, and authentication would
proceed from there.
NOTE
The
dc
values are not case sensitive, so
dc=EXAMPLE
and
dc=example
are equivalent.
The Directory Server can also use a broader mapping scheme, such as the following:
objectclass: top
objectclass: nsSaslMapping
cn: mymap2
nsSaslMapRegexString: \(.*\)
nsSaslMapBaseDNTemplate: ou=People,dc=example,dc=com
nsSaslMapFilterTemplate: (cn=\1)
This will match any user ID and map to the result of the the subtree search with base
ou=People,dc=example,dc=com
and filter
cn=
userId
.
The Directory Server has pre-defined SASL mapping rules to handle some of the most common
cases:
•
Kerberos UID Mapping.
This mapping matches a Kerberos principal using a two part realm, such
as
user
@example.com
. The realm is then used to define the search base, and the
authid
defines the filter. In this example, the search base would be
dc=example,dc=com
and the filter of
(uid=user)
.
•
RFC 2829 DN Syntax.
This mapping matches an
authid
that is a valid DN (defined in RFC 2829)
prefixed by
dn:
. The
authid
maps directly to the specified DN.
•
RFC 2829 U Syntax.
This mapping matches an
authid
that is a UID prefixed by
u:
. The value
specified after the prefix defines a filter of
(uid=value)
. The search base is hard-coded to be the
suffix of the default
userRoot
database.
•
uid Mapping.
This mapping matches an
authid
that is any plain string that does not match the
other default mapping rules. It use this value to define a filter of
(uid=value)
. The search base is
hard-coded to be the suffix of the default
userRoot
database.
12.3. Configuring SASL Identity Mapping from the Console
To create a new SASL identity mapping, do the following:
1. In the Directory Server Console, open the
Configuration
tab.