Hi,
So I'm at the same point I got stuck at when I was originally
trying to upgrade my sssd
(
https://fedorahosted.org/pipermail/sssd-devel/2011-September/007007.html). The
ldap_sasl_bind is failing.
I'm not sure how to deal with an "unknown error". I'm pretty sure my
ldap_sasl_authid is correct (it matches my keytab file) but here's my config anyway:
[domain/XXX.XXX.XXX]
ldap_sasl_mech = gssapi
ldap_sasl_authid = host/myhost.xxx.xxx.xxx(a)XXX.XXX.XXX
ldap_krb5_keytab = /etc/krb5.keytab
ldap_krb5_init_creds = true
ldap_tls_cacertdir = /etc/openldap/cacerts
Does anything look out of place?
you can of course check the keytab owner/permissions/context and the
contents of /etc/krb5.conf but more importantly you should make sure
manually that the keytab can be used to communicate with the server:
# klist -ke /etc/krb5.keytab
# kinit -k -t /etc/krb5.keytab 'host/myhost.xxx.xxx.xxx(a)XXX.XXX.XXX'
# ldapsearch -Y GSSAPI -H ldap://myadserver.xxx.xxx.xxx/ -b
"ou=Accounts,dc=xxx,dc=xxx,dc=xxx" -N
"(&objectClass=user)(sAMAccountName=someuser))"
If kinit fails try other possibly existing keys in the keytab. If none
of them work you'll need to get a valid keytab. If the above steps work
then it sounds more like an SSSD issue.
Cheers,
--
Marko Myllynen