Thanks for the reply Rob.
I did manage to solve the error by changing the permissions on the ds.keytab
file.
I can finally do ldapsearch with gssapi. BTW, I was just wondering, would
there be any way i can make ldap as the database for the kerberos principals.
Isn't it that when get a ticket from kerberos it supposed to look into ldap for
its principals?
Thanks,
John Robert Mendoza
--- On Mon, 7/20/09, Rob Crittenden <rcrit...@redhat.com> wrote:
From: Rob Crittenden <rcrit...@redhat.com>
Subject: Re: [389-users] MIT Kerberos and FDS integration
To: "General discussion list for the 389 Directory server project."
<fedora-directory-users@redhat.com>
Date: Monday, 20 July, 2009, 9:38 PM
John Robert Mendoza wrote:
> Actually i use the
>
> #/usr/lib/mozldap/ldapsearch
>
> There is no option for the -Y.
>
> I can bind using GSSAPI by this command
>
> #/usr/lib/mozldap/ldapsearch -o "mech=GSSAPI" -b "my suffix" objectclass=*
>
> and it outputs this error
>
> ldapsearch: started Mon Jul 20 16:33:07 2009
>
> ldap_init( localhost, 389 )
> Bind Error: Invalid credentials
> Bind Error: additional info: SASL(-1): generic failure: GSSAPI Error:
> Unspecified GSS failure. Minor code may provide more information (Permission
> denied)
>
Check the permission and ownership of the DS keytab.
rob
-----Inline Attachment Follows-----
--
389 users mailing list
389-us...@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
Design your own exclusive Pingbox today! It's easy to create your
personal chat space on your blogs. http://ph.messenger.yahoo.com/pingbox--
389 users mailing list
389-us...@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
