This is a bug in Cyrus-SASL, v1.5.24. Fixed in the CVS version.

        This is the patch you will have to apply:
        --- plugins/gssapi.c.ORIG       Wed Mar  7 19:42:31 2001
        +++ plugins/gssapi.c    Wed Mar  7 19:43:35 2001
        @@ -1243,7 +1243,7 @@
        
                /* need bits of layer */
                allowed = secprops.max_ssf - external;
        -       need = secprops.min_ssf - external;
        +       need = secprops.min_ssf < external ? 0 : secprops.min_ssf - external;
                serverhas = ((char *)output_token->value)[0];
        
               /* if client didn't set use strongest layer available */

        The fixed gssapi.c have version higher than 1.39, so double check before applying!

The following command core dumps: 'ldapsearch -H ldaps://<servername>/ -x', while -Z works.

        This is a bug in OpenLDAP 2.0.7, fixed in the CVS version.

        See all about this bug at the OpenLDAP ITS, Bug number 889.
        http://www.openldap.org/its/index.cgi/Software%20Bugs?id=889