Re: rootdn DN is invalid.

[Jeremy Hallum <jhallum@umich.edu>]

Sadly, I tried it with those lines, and it doesn't seem to be happy with 
it.  

Here's a look at my entire slapd.conf file:


{root}134: more openldap/slapd.conf
# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.8.8.7 2001/09/27 
20:00:31 kur
t Exp $
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include         /usr/Sol/openldap/etc/openldap/schema/core.schema
include         /usr/Sol/openldap/etc/openldap/schema/cosine.schema
include         /usr/Sol/openldap/etc/openldap/schema/inetorgperson.schema
include         /usr/Sol/openldap/etc/openldap/schema/nis.schema
include         /usr/Sol/openldap/etc/openldap/schema/autofs.schema
#include                /etc/openldap/schema/redhat/kerberosobject.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral       ldap://root.openldap.org
#loglevel               552
loglevel                -1
pidfile         /var/run/slapd.pid
argsfile        /var/run/slapd.args
allow   bind_v2
#
# The next three lines allow use of TLS for connections using a dummy test
# certificate, but you should generate a proper certificate by changing to
# /usr/share/ssl/certs, running "make slapd.pem", and fixing permissions 
on
# slapd.pem so that the ldap user or group can read it.
 TLSCipherSuite HIGH:MEDIUM:+SSLv2 
 TLSCertificateFile /usr/Sol/openldap/etc/openldap/server.pem
 TLSCertificateKeyFile /usr/Sol/openldap/etc/openldap/server.pem
 TLSCACertificateFile /usr/Sol/openldap/etc/openldap/server.pem
# TLSVerityClient demand
sasl-host sol.astro.lsa.umich.edu
sasl-realm LSA.UMICH.EDU
sasl-secprops noplain,noanonymous,minssf=56,maxssf=56

#include the access lists
include                 /usr/Sol/openldap/etc/openldap/slapd.access

database        bdb
suffix          "dc=astro-lsa-umich,dc=edu"
sasl-regexp
     uid=(.*),cn=LSA.UMICH.EDU,cn=gssapi,cn=auth
     uid=$1,ou=admin,dc=astro-lsa-umich,dc=edu
rootdn          "uid=astrldapadmin,realm=LSA.UMICH.EDU,cn=gssapi,cn=auth"
# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd/tools. Mode 700 recommended.
directory       /var/lib/ldap
mode            0600
#defaultaccess   search
# Indices to maintain
index   objectClass,uid,uidNumber,gidNumber,memberUid   eq
index   cn,mail,surname,givenname                       eq,subinitial

--

Thanks for any help that anyone can give.  
With the default admin, I can do a 

ldapsearch -H ldap:/// -I -b "" -s base -LLL supportedSASLMechanisms

and get an get a service ticket with any kerberos account, so ldap seems 
to be happy with at least some of the heimdal kerberos libs.



					-jeremy


--
+================================================================+
  Jeremy Hallum, System Manager , Astronomy, University of Michigan
              jhallum@umich.edu::jhallum@dreamt.org
                    "Audentis Fortuna Iuvat"