Da Rock wrote: > I'm not sure you quite understand what I mean here- I think I do. ;-) There's no reason why you shouldn't be able to do the following: LDAP Client --ldap:// with SASL/GSSAPI--> slapd --KRB5--> heimdal KDC --ldapi:// with SASL/EXTERNAL--> slapd In fact the picture is a bit more complicated but I'm too tired to draw the real one. Hope you get the idea. Ciao, Michael.