LDAP users trying to authenticate get error 50 Insufficient access (openldap)

user_4850949 0
Viewed 214

After our ldap database suddenly became corrupt for no obvious reason, I had to restore an older database. This seemed to have worked, and I am able to access, browse and even update entries in the LDAP using an LDAP explorer client. Browsing entries is even possible anonymously.

However, applications that are trying to authenticate users against the LDAP, now fail with LDAP: error code 50 - Insufficient Access Rights

I can reproduce the issue using ldapwhoami:

$ ldapwhoami -vvv -h ldap.localnet -D       
'uid=username,cn=users,dc=unimatrix1,dc=localnet' -x -W
ldap_initialize( ldap://ldap.localnet )
Enter LDAP Password: 
ldap_bind: Insufficient access (50)

I get the same result when trying this with a newly added user. So I assume that an ACL is missing or wrong, however, I haven't made any changes to them, and the ldif files still date to 3 years ago.

How do I re-establish authentication for all users in LDAP?

It's Open Directory on macOS Sierra (OpenLDAP-523.30.2), in case that matters.

Addendum

There is this entry as the last one in /etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif

olcAccess: {22}to *  by set.exact="user/uid & [cn=admin,cn=groups,dc=unimatrix
 1,dc=localnet]/memberUid" write  by dn.base="uid=_ldap_replicator,cn=users,dc
 =unimatrix1,dc=sssnet" write  by sockurl.exact="ldapi://%2Fvar%2Frun%2Fldapi" 
  write  by * read

I suppose I should somehow add by anonymous auth before by * read?

There's also this entry which I'm not sure of if that affects authentication?

olcAccess: {14}to dn.one="cn=computers,dc=unimatrix1,dc=localnet"  attrs=entry
 ,apple-realname,cn,description,macAddress,authAuthority,userPassword  by set.
 exact="user/uid & [cn=admin,cn=groups,dc=unimatrix1,dc=localnet]/memberUid" w
 rite  by sockurl.exact="ldapi://%2Fvar%2Frun%2Fldapi" write  by dnattr=creato
 rsName write  by * read

Update

I just found out that, using ApacheDirectoryStudio, I can authenticate using 'CRAM-MD5 (SASL)', but I get error 50 if I select 'Simple authentication'. I was able to verify it using ldapwhoami like this:

$ ldapwhoami -vvv -h ldap.localnet -U username -W
ldap_initialize( ldap://ldap.localnet )
Enter LDAP Password: 
SASL/SRP authentication started
SASL username: username
SASL SSF: 256
SASL data security layer installed.
dn:uid=username,cn=users,dc=unimatrix1,dc=localnet
Result: Success (0)

So now it looks to me as if the LDAP used to allow Simple authentication, but has somehow lost this configuration when I restored the database. I don't even know where and how this is configured?

openldap ldap authentication
1 Answers

The problem may occur when UniqueID in the restored LDAP data differ from the uid used by the system (for whatever reason).

To verify if that is the problem, check the user entry in the LDAP for the value in the UniqueID attribute.

Then open a shell on the server and check uid used there:

$ id -u username
1003

If applicable, you may also take a look at the home directory of the use with uid displayed (option -n). For example (on macOS the home directories are in /Users):

$ ls -aln /Users
drwxr-xr-x+  18 1003  20    612 Jun  5  2018 username

If the ids are not identical, then change the UniqueID in the LDAP data to match the uid of the user.

Alternatively, you may try to change the owner of the home directory

$ chown -R username /Users/username

but the uid may be have been used in other areas of the system, so the preferred way is to change UniqueID in the LDAP entry.

user_48509490
Related