[Date Prev][Date Next]
Re: Problems with OpenLDAP 2.1.4 and Kerberos
--On Wednesday, September 18, 2002 2:27 PM -0700 Anthony Brock
I have successfully installed and tested Kerberos 5-1.2.6 and SASL
2.1.7. I am able to login, authenticate and interact using these
protocols (using a W2K Active Directory KDC). However, I am unable to
get this working with OpenLDAP. This is also after reading through and
following the steps outlined at http://www.bayour.com/LDAPv3-HOWTO.html
This is the third time I have attempted this, and I have browsed through
most of the mailing list archives for the past 6 months. At this point,
I can successfully perform the following command (and receive results):
ldapsearch -H ldaps://<AD Controller>/ -x -D <AD DN> -W -b <AD Base>
-LLL "SAMAccountName=<AD Login Name>"
However, when I try:
ldapsearch -H ldaps://<AD Controller>/ -I -b <AD Base> -LLL
"SAMAccountName=<AD Login Name>"
I receive "ldap_sasl_interactive_bind_s: Local error (82)". I have
attempted this with the Solaris "truss" command, but am not certain if
this output is informative. I am including a small sample transcript of
the session and the output of a truss command.
We are running openldap-2.1.4 with krb5-1.2.5 and cyrus-sasl 2.1.7 without
I would ask the following:
1) On your ldap server, do you have ldap/<FQDN>@realm keytab in krb5.keytab?
2) For the startup script for slapd, does it look something like:
case $1 in
echo "slapd service starting."
/usr/local/lib/slapd -h "ldap:/// ldaps:///" 1>/dev/console 2>&1
Also, you then need to make sure you have some utility (I suggest k5start)
obtaining the k5 ticket. We run ours out of inittab, for example:
mk:3:respawn:/usr/local/bin/k5start -f /etc/krb5.keytab -u ldap -i
ldap3.stanford.edu -t -l 25h -k /tmp/ldap_service.tkt -K 30 >/dev/null
If you are doing even a semi-successful bind, you should see a ldap/*
service principal ticket in your k5 ticket cache after running ldapsearch.
Hope this helps!
Senior Systems Administrator
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html