Topic: Help with LDAP parametres

[CraigZA]

Hey all, I'm trying to authenticate a second OpenVPN and Squid box against my SME8b6 LDAP, but I'm having trouble with some of the parametres req., specifically:

Base DN = ??  (Google suggests dc=domain;dc=local)
Authentication containers = ??  (Again, Google suggests ou=Users;dc=domain;dc=local)
Bind Credentials = Use anonymous
User Naming Attribute = cn (this is the default, not sure if it's correct?)
Group Naming Attribute = cn (this is the default, again not sure if correct?)
Group Member Attribute = member (again this is the default??)

I have phpldapadmin contrib installed, can see my LDAP schema here --> http://imageshack.us/photo/my-images/121/phpldapinfo.jpg/

I can see the Users OU and Groups OU from the OpenVPN box, and the UID values, but with the above parameters in authentication fails.

Any advice/assistance appreciated!

Craig.

[Daniel B.]

Base DN = ??  (Google suggests dc=domain;dc=local)

From your screenshot, we can see that your base dn is dc=hn,dc=local (, is the separator, not ;).
Users container is ou=User,$basedn, so your user container is ou=User,dc=hn,dc=local

Bind Credentials = Use anonymous

Anonymous binds should be OK

User Naming Attribute = cn (this is the default, not sure if it's correct?)

User naming attribute is uid

Group Naming Attribute = cn (this is the default, again not sure if correct?)

This is correct

Group Member Attribute = member (again this is the default??)

Group member attribute is memberUid, but the application needs to know how to work with posixGroup (group membershipd can be represented in a lot of different ways in LDAP, SME uses posixGroup objectClass for groups which is quite common, so it should work with most applications)

In any case, SME won't allow authentication over an insecure link, you have to either use SSL (ldaps on port 636) or TLS (ldap on port 389, with STARTTLS), or the authentication will fail.

To debug your issue, you can have a look at ldap logs on the SME box in /var/log/ldap/current. LDAP logs can be a bit hard to read, but when an error occures, you should get an error code, adn google will tell to what this code means.

Regards, Daniel