Thanks for the reply Rob. I did manage to solve the error by changing the permissions on the ds.keytab file. I can finally do ldapsearch with gssapi.? BTW, I was just wondering, would there be any way i can make ldap as the database for the kerberos principals. Isn't it that when get a ticket from kerberos it supposed to look into ldap for its principals? Thanks, John Robert Mendoza --- On Mon, 7/20/09, Rob Crittenden <rcritten at redhat.com> wrote: From: Rob Crittenden <rcritten at redhat.com> Subject: Re: [389-users] MIT Kerberos and FDS integration To: "General discussion list for the 389 Directory server project." <fedora-directory-users at redhat.com> Date: Monday, 20 July, 2009, 9:38 PM John Robert Mendoza wrote: > Actually i use the > > #/usr/lib/mozldap/ldapsearch > > There is no option for the -Y. > > I can bind using GSSAPI by this command > > #/usr/lib/mozldap/ldapsearch -o "mech=GSSAPI" -b "my suffix" objectclass=* > > and it outputs this error > > ldapsearch: started Mon Jul 20 16:33:07 2009 > > ldap_init( localhost, 389 ) > Bind Error: Invalid credentials > Bind Error: additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.? Minor code may provide more information (Permission denied) > Check the permission and ownership of the DS keytab. rob -----Inline Attachment Follows----- -- 389 users mailing list 389-users at redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users Design your own exclusive Pingbox today! It's easy to create your personal chat space on your blogs. http://ph.messenger.yahoo.com/pingbox -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.fedoraproject.org/pipermail/389-users/attachments/20090721/a78b46a2/attachment.html
