title: OpenLDAP SASL Authentication
body: <p>I'm setting up this authentication through OpenLDAP:</p>
  
  <p>OpenLDAP -> Pass-through (External authentication) -> SASL -> PAM -> RSA Agent</p>
  
  <p>In order to access to an application via a RSA Token.</p>
  
  <p>Starting from the bottom to the top:</p>
  
  <p>This is my PAM configuration:</p>
  
  <pre><code>#%PAM-1.0
  auth required pam_securid.so
  account      sufficient pam_ldap.so
  account    include      password-auth
  password      sufficient pam_ldap.so
  password   include      password-auth
  </code></pre>
  
  <p>This test works great:</p>
  
  <pre><code>[root@ldap ~]# testsaslauthd -u goingsolo -p 11111111
  0: OK "Success."
  </code></pre>
  
  <p>OpenLdap is correctly configured to works with the SASL Authenticatino in PLAIN:</p>
  
  <pre><code>[root@ldap /]# ldapsearch -h localhost -b "" -LLL -s base supportedSASLMechanisms -x
  dn:
  supportedSASLMechanisms: PLAIN
  </code></pre>
  
  <p>And the <code>userPassword</code> of my goingsolo user is configured with <code>{SASL}goingsolo</code> And if I do a SASL bind it works:</p>
  
  <pre><code>[root@datap-keldap-1-n01 /]# ldapsearch -h localhost -b dc=ldap,dc=com -U "goingsolo" -w 11111111                  
  SASL/PLAIN authentication started
  0: OK "Success."
  </code></pre>
  
  <p>The problem is when I perform a simple bind with -D instead of -U, I receive invalid credentials:</p>
  
  <pre><code>[root@datap-keldap-1-n01 /]# ldapsearch -h localhost -b dc=ldap,dc=com -D "cn=goingsolo,ou=People,dc=ldap,dc=com" -w 11111111                  
  ldap_bind: Invalid credentials (49)
  </code></pre>
  
  <p>Also when performing a sasl bind with the full dn, the authentication fails because from the /var/lag/messages:</p>
  
  <pre><code>Mar 27 19:01:00 ldap saslauthd[11777]: do_auth         : auth failure: [user=cn=goingsolo,ou=People,dc=ldap,dc=com] [service=ldap] [realm=] [mech=pam] [reason=PAM auth error]
  </code></pre>
  
  <p>I guess this is because it does not a translate from the full dn to the simple user (goingsolo).</p>
  
  <p>Any tips on what should I check?</p>