[Date Prev][Date Next]
Re: GSSAPI and LVS Load balanced ldap servers
On 3 Feb 2009, at 01:31, Frank Swasey wrote:
Yeah, that's my guess too of the current failure.
The problem is that both the client and the server must have a
matching idea of the service principal to use in establishing the
The client will use ldap/ldap.uvm.edu, as that's the only name it
knows the server by. However, the server will end up using ldap/
hostname() and therefore the two won't match, and you'll get these
There is a work around for this at the GSSAPI layer, which is to tell
the server to trust any principal that exists in the service's keytab.
Unfortunately, Cyrus SASL doesn't seem to expose a mechanism for doing
this, and so the only way to do so is via a code change to the SASL