Thanks for the reply Rob.
I did manage to solve the error by changing the permissions on the ds.keytab file.
I can finally do ldapsearch with gssapi. BTW, I was just wondering, would there be any way i can make ldap as the database for the kerberos principals.
Isn't it that when get a ticket from kerberos it supposed to look into ldap for its principals?
Thanks,
John Robert Mendoza
--- On Mon, 7/20/09, Rob Crittenden <rcritten@xxxxxxxxxx> wrote:
From: Rob Crittenden <rcritten@xxxxxxxxxx>
Subject: Re: [389-users] MIT Kerberos and FDS integration
To: "General discussion list for the 389 Directory server project." <fedora-directory-users@xxxxxxxxxx>
Date: Monday, 20 July,
2009, 9:38 PM
John Robert Mendoza wrote:
> Actually i use the
>
> #/usr/lib/mozldap/ldapsearch
>
> There is no option for the -Y.
>
> I can bind using GSSAPI by this command
>
> #/usr/lib/mozldap/ldapsearch -o "mech=GSSAPI" -b "my suffix" objectclass=*
>
> and it outputs this error
>
> ldapsearch: started Mon Jul 20 16:33:07 2009
>
> ldap_init( localhost, 389 )
> Bind Error: Invalid credentials
> Bind Error: additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Permission denied)
>
Check the permission and ownership of the DS keytab.
rob
-----Inline Attachment Follows-----
|
Yahoo! Toolbar is now powered with Free Anti-Virus and Anti-Adware Software.
Download Yahoo! Toolbar now!
--
389 users mailing list
389-users@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-directory-users
