[SSSD] can't connect to openldap using GSSAPI

Alexander Gordeev lasaine at lvk.cs.msu.su
Fri Jun 25 21:33:44 UTC 2010


В Fri, 25 Jun 2010 17:54:33 +0200
Sumit Bose <sbose at redhat.com> пишет:

> On Fri, Jun 25, 2010 at 03:20:24PM +0400, Alexander Gordeev wrote:
> > On Fri, 25 Jun 2010 13:10:52 +0200
> > Sumit Bose <sbose at redhat.com> wrote:
> > 
> > > On Fri, Jun 25, 2010 at 02:35:19PM +0400, Alexander Gordeev wrote:
> > > > On Fri, 25 Jun 2010 11:25:22 +0200
> > > > Sumit Bose <sbose at redhat.com> wrote:
> > > > 
> > > > > On Fri, Jun 25, 2010 at 12:55:02PM +0400, Alexander Gordeev wrote:
> > > > > > 
> > > > > > Sorry, I didn't tell you that this log was from another machine, with
> > > > > > it's own key, and therefore I changed ldap_sasl_authid appropriately.
> > > > > > On desktopvm everything is the same i.e. auth fails in the same way.
> > > > > > 
> > > > > > Seems I'll have to dive into debugging SASL... But maybe you have some
> > > > > > hints for me? :)
> > > > > > 
> > > > > > 
> > > > > > -- 
> > > > > >   Alexander
> > > > > 
> > > > > If 
> > > > > 
> > > > > kinit -k -t /etc/krb5.keytab && ldapsearch
> > > > > 
> > > > > works on desktopvm you can try with the credentail cache of sssd
> > > > > /var/lib/sss/db/ccache_GNET (please check if the TGT is still valid
> > > > > before you use it):
> > > > > 
> > > > > KRB5CCNAME=/var/lib/sss/db/ccache_GNET ldapsearch 
> > > > > 
> > > > > should work
> > > > 
> > > > Thanks!
> > > > It works.
> > > 
> > > ok, you mean
> > > 
> > > KRB5CCNAME=/var/lib/sss/db/ccache_GNET ldapsearch
> > > 
> > > works, but sssd doesn't, right ?
> > 
> > Yes, exactly. :)
> > Sorry for ambiguous statements.
> > 
> > > Please make sure to remove any other ccache file before calling
> > > ldapsearch with sssd's ccache file. I'm not sure how clever the
> > > underlying libraries try to be to find a valid TGT. Calling kdestroy
> > > before the ldapsearch should be sufficient.
> > 
> > All the caches were cleaned before the test. But from my experience the
> > underlying libraries don't try to fallback to other caches.
> > 
> > > > > If this work, then I think sssd does something wrong. If it does not
> > > > > work, please compare the content of the ccache you get with 'kinit -k -t
> > > > > /etc/krb5.keytab' with /var/lib/sss/db/ccache_GNET.
> 
> can you check if the attached patch will fix your problem?

Yes, it does! Now it binds ok and gets user and group info!
Thanks a lot!

Now I'll test it thoroughly and will return back if I find any more
bugs. :)

Kudos to all you guys for a very good and unique work!

-- 
  Alexander
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20100626/539f2929/attachment.sig>


More information about the sssd-devel mailing list