[SSSD] Announcing SSSD 1.5.14

Marko Myllynen myllynen at redhat.com
Tue Oct 25 07:47:08 UTC 2011


Hi,

> So I'm at the same point I got stuck at when I was originally trying to upgrade my sssd (https://fedorahosted.org/pipermail/sssd-devel/2011-September/007007.html).  The ldap_sasl_bind is failing.
> 
> I'm not sure how to deal with an "unknown error".  I'm pretty sure my ldap_sasl_authid is correct (it matches my keytab file) but here's my config anyway:
> 
>   [domain/XXX.XXX.XXX]
> 
>   ldap_sasl_mech = gssapi
>   ldap_sasl_authid = host/myhost.xxx.xxx.xxx at XXX.XXX.XXX
>   ldap_krb5_keytab = /etc/krb5.keytab
>   ldap_krb5_init_creds = true
>   ldap_tls_cacertdir = /etc/openldap/cacerts
> 
> Does anything look out of place?

you can of course check the keytab owner/permissions/context and the
contents of /etc/krb5.conf but more importantly you should make sure
manually that the keytab can be used to communicate with the server:

# klist -ke /etc/krb5.keytab
# kinit -k -t /etc/krb5.keytab 'host/myhost.xxx.xxx.xxx at XXX.XXX.XXX'
# ldapsearch -Y GSSAPI -H ldap://myadserver.xxx.xxx.xxx/ -b
"ou=Accounts,dc=xxx,dc=xxx,dc=xxx" -N
"(&objectClass=user)(sAMAccountName=someuser))"

If kinit fails try other possibly existing keys in the keytab. If none
of them work you'll need to get a valid keytab. If the above steps work
then it sounds more like an SSSD issue.

Cheers,

-- 
Marko Myllynen



More information about the sssd-devel mailing list