Configuring SASL DIGEST-MD5 Authentication

This section explains the access control and privilege restrictions on a user using the authorization ID keyword (authzid). If the user is not using the authzid keyword, these restrictions do not apply. Any user that binds using DIGEST-MD5 and the authzid keyword must fulfill the following requirements:

• The authentication ID (authid) must be granted access by an ACI that grants it the proxy right to the authorization ID.

• The authentication ID (authid) entry must contain the proxied-auth privilege. The following example creates a test environment and demonstrates the requirements for user authentication using the DIGEST-MD5 SASL mechanism.

The following example creates a test environment and then demonstrates the requirements for a user authentication using the DIGEST-MD5 SASL mechanism.

1. Import the following entries into the directory. These entries define an ACI and three users:

   • The entry uid=user.0,ou=People,dc=example,dc=com does not have the proxied-auth privilege but is granted proxy access by the ACI.

   • The entry uid=user.1,ou=People,dc=example,dc=com has the proxied-auth privilege but is not granted proxy access by the ACI.

   • The entry uid=user.2,ou=People,dc=example,dc=com has the proxied-auth privilege and is granted proxy access by the ACI.

   dn: ou=People,dc=example,dc=com
   objectClass: top
   objectClass: organizationalunit
   objectClass: posixGroup
   ou: People
   aci: (target="ldap:///uid=proxy user,ou=People,dc=example,dc=com") \
    (targetattr="*") (version 3.0; acl "allow SASL Example"; \
    allow (proxy) userdn="ldap:///uid=user.0,ou=People,dc=example,dc=com || 
    ldap:///uid=user.2,ou=People,dc=example,dc=com";)
   
   dn: uid=user.0,ou=People,dc=example,dc=com
   objectClass: top
   objectClass: person
   objectClass: organizationalperson
   objectClass: inetorgperson
   ...
   description: This is the description for user.0
   
   dn: uid=user.1,ou=People,dc=example,dc=com
   objectClass: top
   objectClass: person
   objectClass: organizationalperson
   objectClass: inetorgperson
   ...
   description: This is the description for user.1
   ds-privilege-name: proxied-auth
   
   dn: uid=proxy user,ou=People,dc=example,dc=com
   objectClass: top
   objectClass: person
   objectClass: organizationalperson
   objectClass: inetorgperson
   ...
   description: This is the description for proxy user
   
   dn: uid=user.2,ou=People,dc=example,dc=com
   objectClass: top
   objectClass: person
   objectClass: organizationalperson
   objectClass: inetorgperson
   ...
   description: This is the description for user.2
   ds-privilege-name: proxied-auth

2. Bind using DIGEST-MD5 as uid=user.1,ou=People,dc=example,dc=com:

   $ ldapsearch --port 1389 -w password --saslOption mech=DIGEST-MD5 \
     --saslOption authid=dn:uid=user.1,ou=People,dc=example,dc=com --saslOption \
     authzid=dn:uid=proxy user,ou=People,dc=example,dc=com --baseDN "" \
     --searchScope base "(objectClass=*)"
    The SASL DIGEST-MD5 bind attempt failed Result Code: 49 (Invalid Credentials)

   The search fails because uid=user.1,ou=People,dc=example,dc=com is not granted the proxy right by the ACI.

3. Bind using DIGEST-MD5 as uid=user.0,ou=People,dc=example,dc=com:

   $ ldapsearch --port 1389 -w password --saslOption mech=DIGEST-MD5 \
     --saslOption authid=dn:uid=user.0,ou=People,dc=example,dc=com --saslOption \
     authzid=dn:uid=proxy user,ou=People,dc=example,dc=com --baseDN "" \
     --searchScope base "(objectClass=*)"
   The SASL DIGEST-MD5 bind attempt failed Result Code: 49 (Invalid Credentials)

   The search fails because uid=user.0,ou=People,dc=example,dc=com does not have the proxied-authproperty.

4. Bind using DIGEST-MD5 as uid=user.2,ou=People,dc=example,dc=com authid with both access control access and the proxied-auth privilege:

   $ ldapsearch --port 1389 -w password --saslOption mech=DIGEST-MD5 \
     --saslOption authid=dn:uid=user.2,ou=People,dc=example,dc=com --saslOption \
     authzid=dn:uid=proxy user,ou=People,dc=example,dc=com --baseDN "" \
     --searchScope base "(objectClass=*)"
   dn: 
   objectClass: ds-root-dse 
   objectClass: top

   The search succeeds because uid=user.2,ou=People,dc=example,dc=com has access allowed by the ACI and the proxied-auth privilege.