RE: can I use a kerberos ticket with ldapsearch (and ldap libraries)

[Luke Howard <lukeh@PADL.COM>]

>This is a limitation of the GSSAPI spec itself, the standard doesn't provide
>an API for setting this option. The Heimdal library provides a function
>"gsskrb5_register_acceptor_identity" for this purpose, but no one uses it
>since it is not part of the GSSAPI standard. The MIT library is hardcoded to
>use the system default keytab. Perhaps you should contact the authors of the
>GSSAPI standard and lobby them to revise the spec to allow setting of
>arbitrary mech-specific options to address this problem.

With MIT, you can declare krb5_overridekeyname and set it to some
arbitary string. Pretty ugly, yes.

-- Luke

--
Luke Howard | lukehoward.com
PADL Software | www.padl.com