Thanks for the reply Rob.

I did manage to solve the error by changing the permissions on the ds.keytab file.

I can finally do ldapsearch with gssapi.  BTW, I was just wondering, would there be any way i can make ldap as the database for the kerberos principals.

Isn't it that when get a ticket from kerberos it supposed to look into ldap for its principals?


Thanks,
John Robert Mendoza

--- On Mon, 7/20/09, Rob Crittenden <rcritten@redhat.com> wrote:

From: Rob Crittenden <rcritten@redhat.com>
Subject: Re: [389-users] MIT Kerberos and FDS integration
To: "General discussion list for the 389 Directory server project." <fedora-directory-users@redhat.com>
Date: Monday, 20 July, 2009, 9:38 PM

John Robert Mendoza wrote:
> Actually i use the
>
> #/usr/lib/mozldap/ldapsearch
>
> There is no option for the -Y.
>
> I can bind using GSSAPI by this command
>
> #/usr/lib/mozldap/ldapsearch -o "mech=GSSAPI" -b "my suffix" objectclass=*
>
> and it outputs this error
>
> ldapsearch: started Mon Jul 20 16:33:07 2009
>
> ldap_init( localhost, 389 )
> Bind Error: Invalid credentials
> Bind Error: additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Permission denied)
>

Check the permission and ownership of the DS keytab.

rob


-----Inline Attachment Follows-----



Yahoo! Toolbar is now powered with Free Anti-Virus and Anti-Adware Software. Download Yahoo! Toolbar now!