Hello,

I have been working on extending an application that searches LDAP server with Kerberos support. I can now bind and then search using the following mechanism:

- Simple Bind - Simple Bind with TLS - Kerberos Bind

I am having issues when I have Kerberos bind and TLS turned on.

I can see the the Kerberos ticket established, the SASL bind to the LDAP server complete, but the LDAP search failing as the message cannot be parsed by the server.

I use the following open source libraries: - OpenLDAP - Cyrus SASL - OpenSSL - Heimdal

In my debugging, I noticed that there are different writers that are installed in the chain. I turned on debugging, and hence I see these writers called in the order listed:

- simple with TLS: sb_debug_write() -> tlso_sb_write() -> sb_debug_write() -> sb_stream_write() - Kerberos Bind: sb_debug_write() -> sb_sasl_generic_write() -> sb_debug_write() -> sb_stream_write() - Kerberos + TLS: sb_debug_write() -> sb_sasl_generic_write() -> sb_debug_write() -> tlso_sb_write() -> sb_debug_write() -> sb_stream_write()

Is this a use case that is supposed to work? What could I be missing?

Thanks! Kris