Lion LDAP Authentication Problem

Question

Level 1

0 points

Lion LDAP Authentication Problem

Hi helpers,

we are using an OpenLDAP server to authenticate our users to different desktop machines. Using SL everything worked just perfect. Now, I upgraded to 10.7 and the login of the LDAP users does not work anymore. I can see all users of the LDAP server listed in the directory service. Furthermore, using dscacheutil, I can get the uid and so on from the LDAP server. Just the password authentification does not work. Using "su", I get "su: Sorry" all the time.

Thanks for your help

J

Mac Pro, Mac OS X (10.7)

Posted on Aug 9, 2011 8:35 AM

Reply

Answer 1

JKasten83 Author

Level 1

0 points

Aug 10, 2011 4:15 AM in response to JKasten83

Just to add a bit more information:

The opendirectoryd.log states: "AppleODClient - unable to open OD connection to Password Server"

Does anybody have the same problems? Is there anybody, who can successfully connect to an LDAP server and use the authentication?

Reply

Answer 2

Aug 15, 2011 5:46 AM in response to JKasten83

Hi

I've the same problem.

su:sorry...

@JKasten83 : You resolved your pb ?

Thanks 🙂

Reply

Answer 3

Aug 15, 2011 5:53 AM in response to JKasten83

Hi

I found a post here with the solution :

https://discussions.apple.com/thread/3200699

Just : after delete AuthenticationAuthority, think to Save at bottom 😉

It's OK !

Bye 🙂

Reply

Answer 4

JKasten83 Author

Level 1

0 points

Aug 18, 2011 10:27 AM in response to JKasten83

Dear TefDesign,

can you please test, if authentication of your users is possible with any password?

Thanks

Reply

Answer 5

samvais

Level 1

0 points

Aug 19, 2011 5:16 AM in response to JKasten83

I'm having a problem with openLDAP authentication. In SL everything works, but in Lion users can log in without password after initial login.

Reply

Answer 6

JKasten83 Author

Level 1

0 points

Aug 19, 2011 5:19 AM in response to JKasten83

I am having the same issues now! Before, it was not possible to login any user. Now, every user can be logged in with any password (restricted to LDAP users). This is a really serious problem.

Reply

Answer 7

JKasten83 Author

Level 1

0 points

Aug 22, 2011 1:10 AM in response to JKasten83

By removing and readding the LDAP server, the strange behavior that NO password is needed was fixed. Now, no LDAP user can be authenticated by password anymore -- this was the initial behavior.

As far as I can see, there are only two options:

1. No LDAP user can login.

2. Every LDAP user can be logged in with any password.

Thus, the problem is still not solved.

Reply

Answer 8

samvais

Level 1

0 points

Aug 23, 2011 6:46 AM in response to JKasten83

I have now reported the problem to Apple via http://www.apple.com/feedback/macosx.html

I'm going to double check if this is related to mobile accounts which we use with the LDAP configuration to allow offline logins. I doubt that's the reason, but I'll try one more time from scratch, just to be sure.

Reply

Answer 9

samvais

Level 1

0 points

Aug 23, 2011 7:29 AM in response to samvais

No change. I did as plain and simple configuration as possible.

1. Edited /etc/openldap/ldap.conf with the path to certificate

2. created simple ldap configuration with directory utility (RFC2307 with SSL): dc=domain,dc=tld

3. booted and noticed there's a minor bug which changes the configuration NOT to use SSL, fixed the configuration and booted again.

4. Logged in with real username and wrong password. Uids and gids of users are correct and dscacheutil -configuration shows the correct servers, but the password is not verified.

Reply

Answer 10

JKasten83 Author

Level 1

0 points

Aug 23, 2011 7:33 AM in response to JKasten83

Thank you for submitting the bug to Apple. Please, keep me informed if you get new information.

Reply

Answer 11

daturan

Level 1

0 points

Aug 23, 2011 11:51 AM in response to JKasten83

noticed a little difference using ldap accounts at the login screen and shell. The shell denies ldap accounts authentication (su - ldap_user) if no password is given. The login screen allows ldap accounts with a blank password.

Reply

Answer 12

Aug 29, 2011 4:56 PM in response to JKasten83

I just spoke to an Apple representative... whose advice is to NOT upgrade to Lion until a fix is found. They have committed to emailing info through once it is available. Let's hope

Reply

Answer 13

Aug 29, 2011 6:14 PM in response to DarrenAus

Curios...

Are you working with ROOT enabled or selected in Directory Utility?

Your LDAP server, what is it? OS etc. Lion?

What happens when you use ldapsearch? From Lion terminal? From other Client Terminal? Using Directory Utility?

Does the Lion Client find the users DN but does not drop and then reconnect using the DN?

Can the loged in user access any other services on the network?

Do they access

Are you using mixed authentication methods?

What is the relationship LDAP has with these if any? (Kerberos authentication of LDAP clients, LDAP Auth supporting kerberos, etc.?)

I think we have a very simple fix but need to know more...

Thanks

Reply

Answer 14

Aug 29, 2011 11:01 PM in response to JKasten83

Following https://help.apple.com/advancedserveradmin/mac/10.7/#apdAE970666-0053

Reply

Answer 15

Aug 29, 2011 11:46 PM in response to JKasten83

OpenLDAP website (www.openldap.org)—learn about the open source software that

Open Directory uses to provide LDAP directory service.

RFC3377, “Lightweight Directory Access Protocol (v3): Technical Specification”

(www.rfc-editor.org/rfc/rfc3377.txt)—lists a set of eight other Request for Comment

(RFC) documents with overview information and detailed specifications for the

LDAPv3 protocol.

Reply