▼

Thursday 27 August 2009

Error "ldap_sasl_interactive_bind_s: Unknown authentication method (-6)" on a LDAPSearch command ...

Whilst building my mega Connections / Domino / Portal / Quickr / Sametime / WCM environment recently, I was using the LDAPSearch command that's available with many Unix installations, including Red Hat Enterprise Linux and Apple OSX.

This is a commonly-used command, and has a fairly simple syntax e.g.

ldapsearch -h hostname.domain.com cn=foobar

or: -

ldapsearch -h hostname.domain.com -b o=organisation cn=foobar

or: -

ldapsearch -h hostname.domain.com -b o=organisation -D cn=admin -w password cn=foobar

However, I kept seeing the error: -

SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available: 

After a quick Google search, it appears that that the LDAPSearch command that I was using is based upon the OpenLDAP product, which defaults to using an authentication mechanism called Simple Authentication and Security Layer (SASL).

Therefore, the LDAPSearch command was expecting to find a SASL-enabled server at the other end - given that I wasn't using OpenLDAP as a server ( I was actually using Domino LDAP ), the trick was to disable the SASL authentication on the client, using the -X switch e.g.

ldapsearch -x -h hostname.domain.com cn=foobar

or: -

ldapsearch -x -h hostname.domain.com -b o=organisation -D cn=admin -w password cn=foobar

Thanks to this blog post for the answer.
at

25 comments:

  1. Mike Howell23 July 2010 at 16:38

    You just saved my bacon. :-)

    ReplyDelete
  2. Dave Hay23 July 2010 at 16:44

    Hi Mike, awesome, glad to hear it, I often search back through my own blog to find stuff that I've learnt, and then forgotten, in the past :-)

    ReplyDelete
  3. Pankaj Jangid9 February 2011 at 06:01

    Thanks. This is useful.

    ReplyDelete
  4. Unknown24 February 2011 at 01:05

    thank you so much!! saved me hours worth of headache!

    ReplyDelete
  5. Dave Hay25 February 2011 at 10:08

    @Umair - thanks for the update

    ReplyDelete
  6. Rocketman7 July 2011 at 18:42

    Same here. Simple solution to a potentially headache-inducing issue. Thanks!

    ReplyDelete
  7. Joshua Davies10 August 2011 at 16:32

    Great tip - thanks!

    ReplyDelete
  8. Unknown19 March 2012 at 17:06

    Saved me too! Many thanks!

    My situation: doing an ldapsearch from MacOSX to a Tivoli Directory Service LDAP server running on z/OS

    ReplyDelete
  9. FlyingMG26 November 2012 at 12:33

    a small parameter causing a big issue. this helped me saving much time. Thank you!

    ReplyDelete
  10. Dave Hay26 November 2012 at 12:59

    @Marc - no problems, glad to be of service :-)

    ReplyDelete
  11. Dave Hay18 December 2012 at 20:43

    @EdGore, daft question, but check that you're specifying the correct host name or IP address, and port number, for LDAPSearch. Also, if you're using LDAP-over-SSL, then there's more work to be done before you can connect, regards, Dave

    ReplyDelete
  12. esb.b4u20 May 2013 at 20:18

    your post is still going strong! thanks for your expertise!!!!

    ReplyDelete
  13. Dave Hay20 May 2013 at 21:03

    @esb.b4u - always glad to help :-)

    ReplyDelete
  14. Nelson Sproul21 October 2013 at 17:00

    @edgore: I too saw the "can't contact LDAP server (-1)" error until I started referring to the DC by IP. Not sure why DNS wasn't sufficient in this case.

    Thank you, Dave, for the help!

    ReplyDelete
  15. Dave Hay22 October 2013 at 06:02

    @Nelson - glad to be of assistance.

    ReplyDelete
  16. Unknown7 February 2014 at 13:35

    Thanks a lot!

    ReplyDelete
  17. CMDR Unifex2 March 2014 at 21:01

    This post has been here since 2009 and it's still saving people from headaches. This approach worked for me when trying to connect to a Microsoft Active Directory server.

    Thanks Dave.

    ReplyDelete
  18. Dave Hay3 March 2014 at 08:43

    @Gold - glad to be of assistance, cheers, Dave

    ReplyDelete
  19. Boris Epstein28 June 2014 at 19:53

    Thanks! This helped me too:)

    ReplyDelete
  20. Jan-Wolter21 August 2014 at 15:46

    It works now! Thx

    ReplyDelete
  21. Unknown3 July 2017 at 17:26

    Thank you. This helped me lots!!

    ReplyDelete
  22. Dave Hay3 July 2017 at 17:29

    Daniel, great news, glad to be of assistance :-) Dave

    ReplyDelete
  23. Unknown9 March 2018 at 10:28

    Thanks alot
    ...it worked for me....

    Manohar kusa from India...

    ReplyDelete
  24. Robert10 April 2019 at 11:09

    Hi,
    the LDAP server I am working on doesn't support simple bind it supports DIGEST-MD5.So I am using this command "ldapsearch -h hostname -p389 -Y DIGEST-MD5 -X () -R=dc=example,dc=com.
    but I am getting the same error. Any advice on this will be appreciated.

    ReplyDelete
  25. Dave Hay11 April 2019 at 08:11

    Hi Robert

    Hmmm, I've not worked with an LDAP that offers that particular authentication mechanism, but there does appear to be experience of similar issues out there, including this: -

    https://serverfault.com/questions/744050/how-to-get-sasl-authentication-to-work-with-digest-md5-for-openldap

    Sorry to not be of much use :-(

    Dave

    ReplyDelete