[Date Prev][Date Next] [Chronological] [Thread] [Top]

seperate keytab files



Is there a way to run MIT kerberos v5 1.3.x and openldap 2.2.x using
cyrus-sasl without setting KRB5_KTNAME environment variable?

The reason I want to do this is because I have other kerberized
applications running whose authentication fails if I set
KRB5_KTNAME=/xxx/ldap.keytab (which contains the LDAP service
principle), for GSSAPI auth. I don't want ldap to have access to the
/etc/krb5.keytab file.

I have tried setting default_keytab-name=/etc/krb5.keytab in the
[libdefaults] section of my krb5.conf file and then setting
KRB5_KTNAME=/xxx/ldap.keytab without any success.

Please help.

Thanks.
GS