[Date Prev][Date Next]
Re: OpenLDAP and SASL
On Thu, 7 Jun 2001, Kurt D. Zeilenga wrote:
> At 05:58 AM 6/6/2001, Jan Marek wrote:
> >Is there some documentation, HOWTO, or step-by-step, how is
> >possible to set OpenLDAP to work with SASL?
> Have you gotten Cyrus's sample client/server to work?
I am currently working my way through the HOWTO guide at
http://www.bayour.com/LDAPv3-HOWTO.html. This has been a helpful guide
but due to my lack of experience with OpenLDAP, SASL, and Kerberos I am
struggling. Plus the guide is written specific to Debian, and I am
working with Red Hat. But that part has not been too bad.
Currently I have built Cyrus SASL with GSSAPI. I applied the
recommended patches to plugins/gssapi.c, and everything seemed to build
In testing Cyrus SASL using the sample-client and sample-server
programs, I am having trouble. I'll just list my questions and I hope
someone can answer them or point me to an answer.
1) The first step described is to "execute kinit" in the shell.
Execute it how? I can run:
and that works fine, but:
kinit -k (do I need to do this?)
kinit(v5) Cannot resolve network address for KDC in requested
realm while getting initial credentials.
My /etc/krb5.conf seems to contain the necessary realm and domain-realm
entries, but something is clearly going astray somewhere.
Side note: in my krb5.keytab file I have an ldap service entry but not a
host entry. I'm starting to think this is a problem, based on some
things I've been reading in the past couple of hours.
2) If I just kinit with my own principal, and then run the sample-client
and sample-server programs, I get:
[root sample]# ./sample-server -s ldap -p /usr/lib/sasl
Generating client mechanism list...
Sending list of 4 mechanism(s)
Waiting for client mechanism....
--- In another shell ---
[root sample]# ./sample-client -s ldap -n <FQDN> -u astreib -p /usr/lib/sasl
Waiting for mechanism list from server...
Choosing best mechanism from: LOGIN PLAIN ANONYMOUS GSSAPI
lt-sample-client: Starting SASL negotiation: generic failure
Above, <FQDN> is the fully qualified name of the host that I'm on.
What's not clear to me, beyond the kinit question, is what username
should I use? Mine? Root? I've tried both, with the same results.
And is there debugging or logs I can check to determine more detail on
the "generic failure" error?
Thanks for any help,