[SSSD] can't connect to openldap using GSSAPI

Sumit Bose sbose at redhat.com
Fri Jun 25 11:10:52 UTC 2010


On Fri, Jun 25, 2010 at 02:35:19PM +0400, Alexander Gordeev wrote:
> On Fri, 25 Jun 2010 11:25:22 +0200
> Sumit Bose <sbose at redhat.com> wrote:
> 
> > On Fri, Jun 25, 2010 at 12:55:02PM +0400, Alexander Gordeev wrote:
> > > 
> > > Sorry, I didn't tell you that this log was from another machine, with
> > > it's own key, and therefore I changed ldap_sasl_authid appropriately.
> > > On desktopvm everything is the same i.e. auth fails in the same way.
> > > 
> > > Seems I'll have to dive into debugging SASL... But maybe you have some
> > > hints for me? :)
> > > 
> > > 
> > > -- 
> > >   Alexander
> > 
> > If 
> > 
> > kinit -k -t /etc/krb5.keytab && ldapsearch
> > 
> > works on desktopvm you can try with the credentail cache of sssd
> > /var/lib/sss/db/ccache_GNET (please check if the TGT is still valid
> > before you use it):
> > 
> > KRB5CCNAME=/var/lib/sss/db/ccache_GNET ldapsearch 
> > 
> > should work
> 
> Thanks!
> It works.

ok, you mean

KRB5CCNAME=/var/lib/sss/db/ccache_GNET ldapsearch

works, but sssd doesn't, right ?

Please make sure to remove any other ccache file before calling
ldapsearch with sssd's ccache file. I'm not sure how clever the
underlying libraries try to be to find a valid TGT. Calling kdestroy
before the ldapsearch should be sufficient.

bye,
Sumit

> 
> > If this work, then I think sssd does something wrong. If it does not
> > work, please compare the content of the ccache you get with 'kinit -k -t
> > /etc/krb5.keytab' with /var/lib/sss/db/ccache_GNET.
> 
> -- 
>   Alexander





More information about the sssd-devel mailing list