WolfeWLU It looks like the ILOM is using the OpenLDAP client but it only does have the authentication sequence.
WolfeWLU It should attempt a rebind to the LDAP server as the user with the password provided after it find the user, however its not doing that. Comparing the login sequence to our normal OpenLDAP clients I can't find a problem.
WolfeWLU It just looks like the ILOM is not rebinding.
WolfeWLU have=half
* teclo-_ (i=42@83.101.7.34) has joined #solaris
* teclo- has quit (Nick collision from services.)
* teclo-_ has quit (Client Quit)
* teclo- (i=42@83.101.7.34) has joined #solaris
* ChanServ gives channel operator status to teclo-
WolfeWLU RADIUS/TACACS support would be nice. LDAP would be fine if the darn thing worked. It requires a BIND DN to do its searching, so I'm thinking it may be expecting access to the userPassword attribute to verify on its own. That would suck from a security point of view.
* tonu has quit ("Leaving")
* _dreams_ has quit ("dreams...")
hile_ Why are you using LDAP for AUTHENTICATION anyhow? LDAP is not an AUTHENTICATION mechanism; it's a directory store
* charlieS rolls eyes
hile_ eh?
charlieS everything auth's off LDAP, and it's very good at it.
* elmer_jfudd (n=fudd@c-71-206-67-81.hsd1.fl.comcast.net) has joined #solaris
hile_ do you not understand the diference between authentication and authorisation?
hile_ LDAP works fine as an AUTHORISATION service, yes
WolfeWLU Yes I do understand the difference.
* charlieS rolls eyes
WolfeWLU LDAP can be used as an authentication mechanism if you set the privileges properly.
WolfeWLU Notably the "auth" ACL.
charlieS when you bind as a user, authentication happens.
WolfeWLU Exaclty.
charlieS if you're authorized to bind :))
WolfeWLU Yup. :-)