On Fri, 29 Jul 2011, Jakub Hrozek wrote:
> On 07/29/2011 12:44 PM, Jakub Hrozek wrote:
>> On 07/29/2011 12:07 PM, John Hodrien wrote:
>>> I've looked at this, but can't see the wood for the trees.
>>>
>>> Starting from 1.59 I can't use GSSAPI or TLS with LDAP. I've tried
all
>>> versions up to current git and I get the same basic result.
>>>
>>> Undefining HAVE_LDAP_INIT_FD by editing the ldap.m4 to remove the test
>>> returns it to life. Equally, not using TLS or GSSAPI works.
>>>
>>> This is pointed at an Active Directory domain, using a machine
>>> credential for the authentication.
>>>
>>> Here's a stack trace from sssd_be aginst the current git HEAD
>>
>>> (d6354aa46716751a41ddab86bc64c1c7c218c5cc) when using GSSAPI:
>> What distribution are you running? What openldap library versions?
>
> Also can you attach your sanitized sssd.conf?
Thanks for the help with this.
CentOS 6.0, but with updated packages built from RHEL SRPMS
(ding-libs/krb5) to support more recent sssd. This likely to be a problem
of my own making?
openldap-2.4.19-15.el6_0.2.x86_64 (original CentOS 6.0 package).
I suspect this to be the source of your problem. This is really archaic
version of openldap when used with SSSD. There have been huge changes in
libldap, more specifically it stopped using openssl as its backend and it is
now utilizing Mozilla NSS instead. Also many other TLS-related fixes have been
made in recent versions.
Please try to use newer libldap, I believe, most recent in RHEL is 2.4.23.
Just to be sure, you can run rpm -q --requires openldap and see if openssl is
there somewhere (there should be none).
Jan