Zimbra GAL Search

[uxbod]

Must have sleepy eyes this morning but cannot get a normal user to be able to query the Zimbra GAL. I have disabled anonymous binds with zmldapanon -d but when I execute

ldapsearch -x -H ldap://zimbra.domain.com:389 -D uid=user,ou=people,dc=domain,dc=com -W -b "ou=people,dc=domain,dc=com" mail=*

I am prompted for the password but when I enter it I get INVALID CREDENTIALS

[uxbod]

I have tried adding to slapd.conf

access to userPassword
    by anonymous auth
    by * none

and then restarting LDAP with

ldap stop ; ldap start

and I still receive the error even though the password is correct.

[uxbod]

Support case 00058201 opened.

[uxbod]

Well, finally I worked it out ... If you are using an external LDAP for Zimbra authentication things like ldapsearch against the Zimbra LDAP will not work This is due to the Z-LDAP instance looking at the local Zimbra password and not following the chain to the external source Hopefully the Zimbra resident LDAP guru will think of a way to handle this

[liverpoolfcfan]

Hey - I think you just figured out something that stumped me for 2 days recently. Now, if only I could remember what I was trying to do when I ran into this roadblock

[Hivos]

Not really a solution, but perhaps a temporary workaround: it does seem to work for Admin accounts. Of course a temporary zmldapanon -e would also do the trick...

[warmbowski]

Is this a bug or normal behavior, or is it a misconfiguration?

I have run into this situation after my process of migrating from 6.0.8 32bit to 6.0.8 64bit following this procedure. And that 32bit install was allowing anonymous external ldap connections, so I wouldn't have noticed this situation before the migration. Now none of my mail clients will search to the GAL via LDAP either anonymously OR when authenticating a user who is not a local user (my admin user works).

Another symptom that I have is that I cannot run the zmldapanon script to either enable or disable anonymous ldap access. It fails with the error Bind: Invalid credentials.

Are you guys having this problem with migrated 32-64 bit systems?