ldapv3.pdf 7947KB Apr 17 2013 11:30:42 AM - mirror omadata

OpenLDAP + SASL + GSSAPI
(OpenLDAP SASL support for Kerberos V)
GSSAPI + OpenLDAP is a delicate combination that can mis-configured in
a variety of ways. Some of the most common mistakes are result in the
following error messages -
ldap_sasl_interactive_bind_s: Local error
The ldap/hostname principle does not exist or the user does not posess a valid
TGT. Be sure to check that the key version numbers are correct, that is they
match tke keys in the LDAP and system keytab files.
ldap_sasl_interactive_bind_s: Can't contact LDAP server
The SSL certificates's CN field may not match the hostname.
gss_acquire_cred: Miscellaneous failure; Permission denied;
This indicates the DSA is having difficulty locating or reading (permissions) the
LDAP keytab file.