[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: GSSAPI and LVS Load balanced ldap servers

On 3 Feb 2009, at 01:31, Frank Swasey wrote:

Yeah, that's my guess too of the current failure.

The problem is that both the client and the server must have a matching idea of the service principal to use in establishing the GSSAPI connection.

The client will use ldap/ldap.uvm.edu, as that's the only name it knows the server by. However, the server will end up using ldap/ hostname() and therefore the two won't match, and you'll get these errors.

There is a work around for this at the GSSAPI layer, which is to tell the server to trust any principal that exists in the service's keytab. Unfortunately, Cyrus SASL doesn't seem to expose a mechanism for doing this, and so the only way to do so is via a code change to the SASL library.