Novell eDirectory 8.8 Troubleshooting Guide - NetIQ

Cause: The realm object’s master key is changed.
Cause: The LDAP service principal object was not found in the subtree of the realm to which it
belongs.
SASL-GSS: Creating GSS context failed
novdocx (en) 11 July 2008
Cause: The time is not in sync between the client, KDC and the eDirectory servers.
Cause: The key of the LDAP service principal was changed in the Kerberos database, but not
updated in eDirectory.
Cause: The encryption type is not supported.
SASL GSSAPI: Invalid user FDN = user_FDN
Cause: The user FDN provided by the client is not valid.
SASL GSSAPI: No user DN is associated with principal client_principal_name
Cause: A user object under the subtree is not attached with the Kerberos principal name.
SASL GSSAPI: More than one user DN is associated with principal
client_principal_name
Cause: More than one user object under the subtree is associated with the same principal.
ldap_simple_bind_s: Invalid credentials major = 1, minor =0
Cause: The cause might be the version mismatch between the ldap service principal on the KDC
server and the ldap service principal on the eDirectory server. This is because every time you extract
the ldap service principal key to the keytab file, the key version number gets incremented.
Action:
Do the following:
1 Update the key in eDirectory server so that the version numbers are in sync.
2 Destroy the tickets at the client.
3 Get the TGT again for the principal.
4 Perform the ldap sasl bind operation.
92 Novell eDirectory 8.8 Troubleshooting Guide