On Tue, 2008-07-01 at 08:41 +0700, Le Trung Kien wrote:
As you know, on each client machine, I type "setup" and go in "Authentication Configuration" then fill up information about kerberos and ldap server. And so, my users could login our Kerberos&LDAP system.
after login, users must get ticket to use ldap services by emit command : "kinit" then type their kerberos password. After get their tickets, they can use ldap services. I have tested this with "ldapwhoami" and get the proper user information (which belongs to ldap). And I have only password on Kerberos for each user. If I were wrong, please show me :) Could you explain to me how SASL gets involved in this ?
OpenLDAP does not use Kerberos directly, instead it uses SASL. If your LDAP server has a Kerberos service principal, and has the SASL GSSAPI plugin installed and enabled, then the OpenLDAP client utilities will try appropriate SASL mechanisms (if the user has a ticket).
So, you are using SASL to authenticate via Kerberos your users when accessing the LDAP service.
Regards, Buchan