[389-users] MIT Kerberos and FDS integration

[John Robert Mendoza]

Thanks for the reply Rob.

I did manage to solve the error by changing the permissions on the ds.keytab file. 

I can finally do ldapsearch with gssapi.  BTW, I was just wondering, would there be any way i can make ldap as the database for the kerberos principals. 

Isn't it that when get a ticket from kerberos it supposed to look into ldap for its principals?


Thanks,
John Robert Mendoza

--- On Mon, 7/20/09, Rob Crittenden <rcritten at redhat.com> wrote:

From: Rob Crittenden <rcritten at redhat.com>
Subject: Re: [389-users] MIT Kerberos and FDS integration
To: "General discussion list for the 389 Directory server project." <fedora-directory-users at redhat.com>
Date: Monday, 20 July, 2009, 9:38 PM

John Robert Mendoza wrote:
> Actually i use the
> 
> #/usr/lib/mozldap/ldapsearch
> 
> There is no option for the -Y.
> 
> I can bind using GSSAPI by this command
> 
> #/usr/lib/mozldap/ldapsearch -o "mech=GSSAPI" -b "my suffix" objectclass=*
> 
> and it outputs this error
> 
> ldapsearch: started Mon Jul 20 16:33:07 2009
> 
> ldap_init( localhost, 389 )
> Bind Error: Invalid credentials
> Bind Error: additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Permission denied)
> 

Check the permission and ownership of the DS keytab.

rob


-----Inline Attachment Follows-----

--
389 users mailing list
389-users at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users



      Design your own exclusive Pingbox today! It's easy to create your personal chat space on your blogs. http://ph.messenger.yahoo.com/pingbox
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.fedoraproject.org/pipermail/389-users/attachments/20090721/a78b46a2/attachment.html>