[SSSD] Announcing SSSD 1.5.14

Marko Myllynen myllynen at redhat.com
Tue Oct 25 07:51:03 UTC 2011


Hi,

>> So I'm at the same point I got stuck at when I was originally trying to upgrade my sssd (https://fedorahosted.org/pipermail/sssd-devel/2011-September/007007.html).  The ldap_sasl_bind is failing.
>>
>> I'm not sure how to deal with an "unknown error".  I'm pretty sure my ldap_sasl_authid is correct (it matches my keytab file) but here's my config anyway:
>>
>>   [domain/XXX.XXX.XXX]
>>
>>   ldap_sasl_mech = gssapi
>>   ldap_sasl_authid = host/myhost.xxx.xxx.xxx at XXX.XXX.XXX
>>   ldap_krb5_keytab = /etc/krb5.keytab
>>   ldap_krb5_init_creds = true
>>   ldap_tls_cacertdir = /etc/openldap/cacerts
>>
>> Does anything look out of place?
> 
> you can of course check the keytab owner/permissions/context and the
> contents of /etc/krb5.conf but more importantly you should make sure
> manually that the keytab can be used to communicate with the server:
> 
> # klist -ke /etc/krb5.keytab
> # kinit -k -t /etc/krb5.keytab 'host/myhost.xxx.xxx.xxx at XXX.XXX.XXX'
> # ldapsearch -Y GSSAPI -H ldap://myadserver.xxx.xxx.xxx/ -b
> "ou=Accounts,dc=xxx,dc=xxx,dc=xxx" -N
> "(&objectClass=user)(sAMAccountName=someuser))"

whoops, typo, the query filter was missing a '(':

... "(&(objectClass=user)(sAMAccountName=someuser))"

> If kinit fails try other possibly existing keys in the keytab. If none
> of them work you'll need to get a valid keytab. If the above steps work
> then it sounds more like an SSSD issue.

Cheers,

-- 
Marko Myllynen



More information about the sssd-devel mailing list