Greetings,
i am new to this list. I have a computer with these:- cpu: amd64 2 cores os linux 64bit distro=cblfs kernel-3.2.1, gcc-4.5.2 auth progs: MIT-kerberos-1.10, sasl-2.1.25. openldap-2.4.29
( I have an inhouse CA and generated a signed Certicate/Key pair on this machine running openssl-0.9.8 I transferred these and the cacert.pem file securely to the machine above and these are included in the slapd.conf file )
I verified ldap is running without sasl with the ldapsearch command like so:- ldapsearch -xWLLL "ou=people" -H ldaps://tester.example.com
When I tried the same command for a sasl bind:- ldappsearch -LLL "ou=people" -H ldaps://tester.example.com
I get this ################################################### SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context ###################################################
(For debugging ) I did the same with the -d -1 switch ldappsearch -LLL -d -1 "ou=people" -H ldaps://tester.example.com
and excerpts from the output are below:- ###################################################### ldap_url_parse_ext(ldaps://tester.example.com) ldap_create ldap_url_parse_ext(ldaps://tester.example.com:636/??base) ldap_sasl_interactive_bind: user selected: GSSAPI ldap_int_sasl_bind: GSSAPI ldap_new_connection 1 1 0 ldap_int_open_connection ldap_connect_to_host: TCP tester.example.com:636 ldap_new_socket: 3 ldap_prepare_socket: 3 ldap_connect_to_host: Trying 10.10.10.10:636 ldap_pvt_connect: fd: 3 tm: -1 async: 0 TLS trace: SSL_connect:before/connect initialization tls_write: want=211, written=211 0000: 16 03 01 00 ce 01 00 00 ca 03 01 4f 52 8f 3c 49 ...........OR.<I 0010: ca 19 83 08 c8 85 c3 00 94 20 0b 48 32 1a c1 40 ......... .H2..@
-------------- TLS trace: SSL_connect:SSLv2/v3 write client hello A tls_read: want=7, got=7 -------------
-------------- TLS trace: SSL_connect:SSLv3 read server hello A tls_read: want=5, got=5 0000: 16 03 01 06 5b --------------
-------------- TLS trace: SSL_connect:SSLv3 read server certificate A tls_read: want=5, got=5 0000: 16 03 01 00 8d ..... tls_read: want=141, got=141
-------------- TLS trace: SSL_connect:SSLv3 read server certificate request A TLS trace: SSL_connect:SSLv3 read server done A TLS trace: SSL_connect:SSLv3 write client certificate A TLS trace: SSL_connect:SSLv3 write client key exchange A TLS trace: SSL_connect:SSLv3 write change cipher spec A TLS trace: SSL_connect:SSLv3 write finished A tls_write: want=210, written=210
-------------- TLS trace: SSL_connect:SSLv3 flush data tls_read: want=5, got=5 0000: 16 03 01 00 ba ..... tls_read: want=186, got=186 ------------------
-------------- TLS trace: SSL_connect:SSLv3 read server session ticket A tls_read: want=5, got=5 0000: 14 03 01 00 01 ..... tls_read: want=1, got=1 0000: 01 . tls_read: want=5, got=5 0000: 16 03 01 00 30 ....0 tls_read: want=48, got=48
-------------- TLS trace: SSL_connect:SSLv3 read finished A ldap_int_sasl_open: host=tester.example.com SASL/GSSAPI authentication started ldap_sasl_bind ldap_send_initial_request ldap_send_server_request ber_scanf fmt ({it) ber: ber_dump: buf=0x20ebed0 ptr=0x20ebed0 end=0x20ec16a len=666
-------------- ldap_msgfree ldap_result ld 0x2018010 msgid 1 wait4msg ld 0x2018010 msgid 1 (infinite timeout) wait4msg continue ld 0x2018010 msgid 1 all 1 ** ld 0x2018010 Connections: * host: tester.example.com port: 636 (default) refcnt: 2 status: Connected last used: Sat Mar 3 21:38:04 2012
** ld 0x2018010 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x2018010 request count 1 (abandoned 0) ** ld 0x2018010 Response Queue: Empty ld 0x2018010 response count 0 ldap_chkResponseList ld 0x2018010 msgid 1 all 1 ldap_chkResponseList returns ld 0x2018010 NULL ldap_int_select read1msg: ld 0x2018010 msgid 1 all 1 ber_get_next tls_read: want=5, got=5 0000: 17 03 01 00 20 .... tls_read: want=32, got=32
-------------- tls_read: want=5, got=5 0000: 17 03 01 00 70 ....p tls_read: want=112, got=112
-------------- ldap_read: want=79, got=79 0000: 01 31 04 00 04 49 53 41 53 4c 28 2d 31 33 29 3a .1...ISASL(-13): 0010: 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 authentication 0020: 66 61 69 6c 75 72 65 3a 20 47 53 53 41 50 49 20 failure: GSSAPI 0030: 46 61 69 6c 75 72 65 3a 20 67 73 73 5f 61 63 63 Failure: gss_acc 0040: 65 70 74 5f 73 65 63 5f 63 6f 6e 74 65 78 74 ept_sec_context ber_get_next: tag 0x30 len 85 contents:
-------------- read1msg: ld 0x2018010 0 new referrals read1msg: mark request completed, ld 0x2018010 msgid 1 request done: ld 0x2018010 msgid 1 res_errno: 49, res_error: <SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_int_sasl_bind: <null> ldap_parse_sasl_bind_result ber_scanf fmt ({eAA) ber: ber_dump: buf=0x20eb750 ptr=0x20eb753 end=0x20eb7a5 len=82 -------------- #########################################################################
advice would be appreciated
sincerely lux-integ