[Date Prev][Date Next]
[Chronological]
[Thread]
[Top]
Re: ldapsearch + read-only domain controller: cannot bind
Thank you for the hint.
However, I'm not running slapd since this is Microsoft AD environment + Linux clients. I've tried to obtain a ticket for service upn as root and got the TGT, so it doesn't look like permissions issue.
15.06.2016, 23:06, "Dieter Klünter" <dieter@dkluenter.de>:
> Am Sun, 12 Jun 2016 17:34:47 +0300
> schrieb l@avc.su:
>
>> Hi Dieter.
>>
>> I've tried performing this search from CentOS6 machine, with my own
>> UPN, with machine UPN, and it were successful. Accessing SPN
>> ldap/dc.contoso.com@CONTOSO.COM Keytab is located
>> in /etc/krb5.keytab, owned by root, access mode 0600. Dumped traffic
>> from the problem server. On myTGS-REQ, DC responds with
>> 'krb5kdc_err_svc_unavailable' packet.
>> 12.06.2016, 10:41, "Dieter Klünter" <dieter@dkluenter.de>:
>>
>> Am Sat, 11 Jun 2016 14:27:26 +0300
>> schrieb l@avc.su:
>
> [...]
>
> the user, slapd runs as, needs to read keytab. Check with klist
> whether a ldap service principal ticket is available.
>
> -Dieter
>
> --
> Dieter Klünter | Systemberatung
> http://sys4.de
> GPG Key ID: E9ED159B
> 53°37'09,95"N
> 10°08'02,42"E