[SSSD] Announcing SSSD 1.5.14
Marko Myllynen
myllynen at redhat.com
Tue Oct 25 07:51:03 UTC 2011
Hi,
>> So I'm at the same point I got stuck at when I was originally trying to upgrade my sssd (https://fedorahosted.org/pipermail/sssd-devel/2011-September/007007.html). The ldap_sasl_bind is failing.
>>
>> I'm not sure how to deal with an "unknown error". I'm pretty sure my ldap_sasl_authid is correct (it matches my keytab file) but here's my config anyway:
>>
>> [domain/XXX.XXX.XXX]
>>
>> ldap_sasl_mech = gssapi
>> ldap_sasl_authid = host/myhost.xxx.xxx.xxx at XXX.XXX.XXX
>> ldap_krb5_keytab = /etc/krb5.keytab
>> ldap_krb5_init_creds = true
>> ldap_tls_cacertdir = /etc/openldap/cacerts
>>
>> Does anything look out of place?
>
> you can of course check the keytab owner/permissions/context and the
> contents of /etc/krb5.conf but more importantly you should make sure
> manually that the keytab can be used to communicate with the server:
>
> # klist -ke /etc/krb5.keytab
> # kinit -k -t /etc/krb5.keytab 'host/myhost.xxx.xxx.xxx at XXX.XXX.XXX'
> # ldapsearch -Y GSSAPI -H ldap://myadserver.xxx.xxx.xxx/ -b
> "ou=Accounts,dc=xxx,dc=xxx,dc=xxx" -N
> "(&objectClass=user)(sAMAccountName=someuser))"
whoops, typo, the query filter was missing a '(':
... "(&(objectClass=user)(sAMAccountName=someuser))"
> If kinit fails try other possibly existing keys in the keytab. If none
> of them work you'll need to get a valid keytab. If the above steps work
> then it sounds more like an SSSD issue.
Cheers,
--
Marko Myllynen
More information about the sssd-devel
mailing list