I’m trying to have one at a time enabled to see if I can get them
working individually before I try them as a whole/group..

I tried all day yesterday, and I could do the initial connection, but

not get any results:

    ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)

I see the connection in syslog on the LDAP server, but don’t get any

results back.



Now, first thing I did this morning was to just run the exact same
command (kinit && ldapwhoami) that I did last night.

AND IT WORKED!!

No idea why! It shouldn’t have. Glad it did, but since I can’t explain
WHY it worked, it’s annoying!! :)


So I then disabled that (working) LDAP server in the LB member list
and enabled the second. And now that is experiencing the same
problem as the first yesterday…

I didn’t change anything else - last thing I did before I went to bed
last night was try the ldapwhoami command -> “can’t contact ldap
server”. And the very first thing I did this morning was kdestroy
my ticket, get a new one and then run ldapwhoami.

I’ve run with multiple types of debugging, but there’s nothing obvious
that I can see, either from ‘-d -1’ or with KRB5_TRACE set).


So … “something” internally in OS changed. Any suggestions to what
or how to debug this?

What is ldap_sasl_interactive_bind_s() actually doing? Why does the

ldap_bind() earlier seem to work, but not the SASL bind?