Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Date: Wed, 13 Jan 2016 17:03:11 +0000 (UTC)
From: "akarypid@yahoo.gr" <akarypid@yahoo.gr>
To: "users@directory.apache.org" <users@directory.apache.org>
Message-ID: <1234733093.7295143.1452704591637.JavaMail.yahoo@mail.yahoo.com>
In-Reply-To: <1876654989.7136615.1452696155162.JavaMail.yahoo@mail.yahoo.com>
References: 
 <1876654989.7136615.1452696155162.JavaMail.yahoo.ref@mail.yahoo.com>
 <1876654989.7136615.1452696155162.JavaMail.yahoo@mail.yahoo.com>
Subject: Re: DIGEST-MD5: digest response format violation. Mismatched
 response.
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_7295142_1478948994.1452704591633"

------=_Part_7295142_1478948994.1452704591633
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

'Well duh' moment... My passwords are stored hashed...

Sent from Yahoo Mail on Android=20
=20
  On Wed, 13 Jan, 2016 at 14:42, akarypid@yahoo.gr<akarypid@yahoo.gr> wrote=
:   Hello,

Context: I am running a 2.0.0-M20 server instance and all testing/trials be=
low where made with Apache Directory Studio 2.0.0.v20150606-M9.

Also, thank you in advance to anyone who takes the time to read through all=
 this and possibly reply with pointers/solutions.

PROBLEM SUMMARY
----------------------------------
I am able to connect with simple authentication and the DN, but I want to b=
e able to also use DIGEST-MD5 and uid-only value instead of full DN. No mat=
ter what I do, I keep getting this error when I try to connect:

=C2=A0 =C2=A0 =C2=A0 DIGEST-MD5: digest response format violation. Mismatch=
ed response.

DETAILS
----------------------------------
I have 2 connections in my Apache Directory Studio (first works, second is =
the one I can't get to work).

The two have identical settings in the "Network Parameter", "Browser Option=
s" and "Edit Options" tabs. Basically it's the defaults, where the network =
parameters were changed to give the host name (myhost.mydomain.com) and por=
t number, and also to enable the StartTLS extension. In fact the second con=
nection was created as a copy of the first (working) one, where I only made=
 changes to the authentication tab:

=C2=A0=C2=A0=C2=A0 1. First (working) connection has method "Simple Authent=
ication"=C2=A0
=C2=A0=C2=A0=C2=A0 Bind DN or user: "uid=3Dadmin,ou=3Dpeople,dc=3Ddevops,dc=
=3Dmydomain,dc=3Dcom"

=C2=A0=C2=A0=C2=A0 2. Second (non-working) connection has method "DIGEST-MD=
5 (SASL)" method
=C2=A0=C2=A0=C2=A0 Bind DN or user: "admin"=C2=A0=C2=A0
=C2=A0=C2=A0=C2=A0 In SASL settings SASL Realm: myhost.mydomain.com

The SASL realm is the server's FQDN from 'hostname -f' command. All other s=
ettings are defaults. When connecting I get this failure in Directory Studi=
o client:

CUT START =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Error while opening connection
- [LDAP: error code 49 - INVALID_CREDENTIALS: DIGEST-MD5: digest response f=
ormat violation. Mismatched response.]
java.lang.Exception: [LDAP: error code 49 - INVALID_CREDENTIALS: DIGEST-MD5=
: digest response format violation. Mismatched response.]
=C2=A0=C2=A0=C2=A0 at org.apache.directory.studio.connection.core.io.api.Di=
rectoryApiConnectionWrapper.checkResponse(DirectoryApiConnectionWrapper.jav=
a:1278)
=C2=A0=C2=A0=C2=A0 at org.apache.directory.studio.connection.core.io.api.Di=
rectoryApiConnectionWrapper.access$9(DirectoryApiConnectionWrapper.java:124=
6)
=C2=A0=C2=A0=C2=A0 at org.apache.directory.studio.connection.core.io.api.Di=
rectoryApiConnectionWrapper$2.run(DirectoryApiConnectionWrapper.java:448)
=C2=A0=C2=A0=C2=A0 at org.apache.directory.studio.connection.core.io.api.Di=
rectoryApiConnectionWrapper.runAndMonitor(DirectoryApiConnectionWrapper.jav=
a:1173)
=C2=A0=C2=A0=C2=A0 at org.apache.directory.studio.connection.core.io.api.Di=
rectoryApiConnectionWrapper.doBind(DirectoryApiConnectionWrapper.java:457)
=C2=A0=C2=A0=C2=A0 at org.apache.directory.studio.connection.core.io.api.Di=
rectoryApiConnectionWrapper.bind(DirectoryApiConnectionWrapper.java:303)
=C2=A0=C2=A0=C2=A0 at org.apache.directory.studio.connection.core.jobs.Open=
ConnectionsRunnable.run(OpenConnectionsRunnable.java:114)
=C2=A0=C2=A0=C2=A0 at org.apache.directory.studio.connection.core.jobs.Stud=
ioConnectionJob.run(StudioConnectionJob.java:109)
=C2=A0=C2=A0=C2=A0 at org.eclipse.core.internal.jobs.Worker.run(Worker.java=
:54)

[LDAP: error code 49 - INVALID_CREDENTIALS: DIGEST-MD5: digest response for=
mat violation. Mismatched response.]
CUT END=C2=A0 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Any idea on what may be causing this?

=C2=A0=C2=A0=C2=A0 * I think the uid and the userPassword values are 100% c=
orrect, since (1) works with those.
=C2=A0=C2=A0=C2=A0 * I also think the SASL realm is correct - using some ot=
her value (e.g. wronghost.mydomain.com) gives "DIGEST-MD5: digest response =
format violation. Nonexistent realm: wronghost.mydomain.com] "=C2=A0

SERVER SETTINGS
----------------------------------
When I use the working connection (1) and "Open Configuration", in the "LDA=
P/LDAPS Servers" tab, I've change the "SASL Settings" tab as follows:

SASL Host: myhost.mydomain.com=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 - NOTE =
this matches the realm
SASL Principal: ldap/myhost.mydomain.com Search Base Dn: ou=3Dpeople,dc=3Dd=
evops,dc=3Dmydomain,dc=3Dcom

In the list of SASL Realms I've added "myhost.mydomain.com" which is the sa=
me as the SASL host. =20

------=_Part_7295142_1478948994.1452704591633--