[Freeipa-users] Re: Inappropriate authentication when binding as service account

[Alexander Bokovoy]

On ma, 11 marras 2019, Joyce Babu via FreeIPA-users wrote:
> Hello,
>
> I am trying to bind to ldap as a service account. I followed the advice in
>
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>
> and created a plain text password using ipa-getkeytab
>
> ipa-getkeytab -s ipa.ennexa.org -p HTTP/service.domain.tld(a)EXAMPLE.COM -P
> -k /tmp/test.keytab
>
> But when I try to bind with the same password, it is failing
>
> ldapsearch -D
> krbprincipalname=HTTP/service.domain.tld(a)EXAMPLE.COM,cn=services,cn=accounts,dc=example,dc=com
> -w "MY_PLAIN_TEXT_PASSWORD" -b cn=groups,cn=accounts,dc=example,dc=com -h
> ipa.example.com:389
> ldap_bind: Inappropriate authentication (48)
>
> Do I have to configure anything else? 
Kerberos services do not have userPassword
attribute set on them when
their key is set via ipa-getkeytab. Thus, 389-ds rejects authentication
because it cannot compute and compare hashes out of the password you
passed with simple LDAP bind.

Please use SASL GSSAPI or SASL GSS-SPNEGO to authenticate, not simple
bind.

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland