[SSSD] sssd and kerberos.

Stephen Gallagher sgallagh at redhat.com
Thu Aug 5 12:25:09 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/05/2010 08:21 AM, Timo Aaltonen wrote:
> On Wed, 4 Aug 2010, Stephen Gallagher wrote:
> 
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 08/04/2010 10:18 AM, Timo Aaltonen wrote:
>>> On Mon, 2 Aug 2010, Patrik Martinsson wrote:
>>>
>>>> ldap_tls_reqcert = demand
>>>> ldap_tls_cacert = /etc/openldap/cacerts/CADOUBLE.cer
>>>> ldap_tls_cacertdir = /etc/openldap/cacerts
>>>
>>> I guess this doesn't work with GSSAPI SASL binding yet? Tried to force the
>>> authid to FOO$@REALM, but it fails just the same.
>>>
>>> it's harder to automatically generate certificates for the clients, that's
>>> why I'm interested in getting this working :)
>>>
>>>
>>
>>
>> I'm not sure what you're asking for here.
>>
>> I think what you're talking about is using:
>> ldap_sasl_mech = gssapi
>> ldap_krb5_keytab = /path/to/ldap.keytab
> 
> I did that, but it doesn't seem to work, or somethings missing still. It 
> said something like "marking ldap server foo as broken" (sorry no logs, 
> reinstalling the machine).
> 
> 

Someone else just reported this same issue to me :(

Can you attach the /var/log/sssd/sssd_<domain>.log and
/var/log/sssd/ldap_child.log for this?

I suspect you'll see the ldap_child.log report that it couldn't find a
KDC for the realm.



- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkxaraUACgkQeiVVYja6o6PB6wCfYrJ+di1t/hOka/WVGuKNcgnC
MhwAni9NyIvG76/G9mmTxmr82DKi+joD
=iCQk
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list