[Fedora-directory-users] FDS, Kerberos, SASL confusion

[Hintermayer Johannes]

Hi Marty and Rob,

thanks for your answers.

The FDS user indeed wasn't able to access /etc/krb5.keytab. After I
changed that, the error message changed to:

[root at vafbds01 ~]# ldapsearch -Y GSSAPI -D "uid=bsmith,ou=People,dc=afb,dc=lan" -v 
ldap_initialize( <DEFAULT> )
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Invalid credentials (49)
        additional info: SASL(-14): authorization failure: 


My klist is as follows:

[root at vafbds01 ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: bsmith at AFB.LAN

Valid starting     Expires            Service principal
07/26/07 08:35:05  07/27/07 08:33:33  krbtgt/AFB.LAN at AFB.LAN



Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached

After that it changes to 

[root at vafbds01 tmp]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: bsmith at AFB.LAN

Valid starting     Expires            Service principal
07/26/07 08:41:36  07/27/07 08:39:33  krbtgt/AFB.LAN at AFB.LAN
07/26/07 08:41:40  07/27/07 08:39:33  ldap/vafbds01.afb.lan at AFB.LAN


Kerberos 4 ticket cache: /tmp/tkt0
klist: You have no tickets cached

So, at least I do get a ticket for ldap.

When I run "kinit bsmith" I get the following log message on my Kerberos
Server:
Jul 26 08:35:05 vafbkrb01 krb5kdc[13704](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.50.2: ISSUE: authtime 1185431705, etypes {rep=16 tkt=16 ses=16}, bsmith at AFB.LAN for krbtgt/AFB.LAN at AFB.LAN
Jul 26 08:35:05 vafbkrb01 krb5kdc[13704](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.50.2: ISSUE: authtime 1185431705, etypes {rep=16 tkt=16 ses=16}, bsmith at AFB.LAN for krbtgt/AFB.LAN at AFB.LAN


When I run "testsaslauthd -s ldap -u bsmith -p letmein" I see the
following log entries:

Jul 26 08:36:37 vafbkrb01 krb5kdc[13704](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.50.2: ISSUE: authtime 1185431797, etypes {rep=16 tkt=16 ses=16}, bsmith at AFB.LAN for krbtgt/AFB.LAN at AFB.LAN
Jul 26 08:36:37 vafbkrb01 krb5kdc[13704](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.50.2: ISSUE: authtime 1185431797, etypes {rep=16 tkt=16 ses=16}, bsmith at AFB.LAN for krbtgt/AFB.LAN at AFB.LAN
Jul 26 08:36:37 vafbkrb01 krb5kdc[13704](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.50.2: ISSUE: authtime 1185431797, etypes {rep=16 tkt=16 ses=16}, bsmith at AFB.LAN for host/vafbds01.afb.lan at AFB.LAN
Jul 26 08:36:37 vafbkrb01 krb5kdc[13704](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.50.2: ISSUE: authtime 1185431797, etypes {rep=16 tkt=16 ses=16}, bsmith at AFB.LAN for host/vafbds01.afb.lan at AFB.LAN


How do I have to set the password for the user bsmith in FDS?
The current setting is: {SASL}bmsith at AFB.LAN
Is that correct?


Regards,

Johannes Hintermayer




On Wed, 2007-07-25 at 15:11 -0400, MJD Shop Account wrote:
> 
> >#klist
> >Ticket cache: FILE:/tmp/krb5cc_0
> >Default principal: bsmith at AFB.LAN
> >
> >#ldapsearch -Y GSSAPI -D "uid=bsmith,ou=People,dc=afb,dc=lan" -v 
> 
> No credentials??  or did you just edit out the result of klist?  You should see at the very least a ticket-granting ticket
> 
> >2. Do I need a host principal for every client?
> >
> 
> This I am pretty sure is a 'yes you do'
> 
> 
> -Marty
> 
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users