Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (athena.apache.org: domain of tlarhices@gmail.com
 designates 209.85.161.178 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:from:date:message-id:subject:to:content-type;
        b=L5bZ7kQ2Jhmgx0DtKn5Y4S7ryFGPM8WRy6W6iN7XIwvO9v8ekV/Q3WKSrEyR8+Mw1+
         tbyDa5RCTTyRzSAT2N3T6A4kX2wCWWfaPyNxo+di9JacVV0uqikRCynwvCv7XOriSOmG
         Cp+RB2Aqd3p2Vs4vdhJiH9g9EmMoruXP0PqLU=
MIME-Version: 1.0
From: Mathias Clerc <tlarhices@gmail.com>
Date: Fri, 20 May 2011 11:06:23 +0900
Message-ID: <BANLkTikQPAVeNDmCN3ru-Jd1rKuocYoSMQ@mail.gmail.com>
Subject: SASL and full DN
To: users@directory.apache.org
Content-Type: text/plain; charset=ISO-8859-1

Hello,

I have one question but as I am fairly new to LDAP as a whole it may
be difficult for you to understand me.

My users have the following structure :
uid=user,ou=people,ou=division,o=company

I have a user "user1" in "division1" and a user "user1" in
"division2". Both users are different.

When I do a simple login, I can login to whichever I want using the
full DN uid=user1,ou=people,ou=division1,o=company or
uid=user1,ou=people,ou=division2,o=company

To make login easier for the users, I use the following algorythm
(idea is from apache DS guide) :
1) login as a special account
2) run a search (&(objectclass=userClass)(uid=username)) with a root
at o=company
3) try to connect to each user found, use the first succefull login as
current login or send an error if it was not possible to log in with
any account

This works perfectly until I use SASL. When I connect wit SASL and a
searchBaseDn set to o=company I can not give a full DN or a DN
relative to the search base.
I can log in by using "user1" id, but the following happens :
uid:user1, password:the one for user1 in division1 : failure
uid:user1, password:the one for user1 in division2 : success

Is it possible to authenticate with SASL using full DN ?
Or is it possible to have SASL+LDAP make a distinction between both account ?
Or is it possible to have SASL+LDAP try each user found against the
password (and not just try one returned randomly) ?
Or is my setup broken ?

Thank you