[Fedora-directory-users] ldap commands require "-Y GSSAPI". Fixable with "Identity Mapping" ?
Rich Megginson
rmeggins at redhat.com
Fri Jan 25 19:57:55 UTC 2008
Listbox wrote:
> Hi folks,
>
> I have sasl-gssapi installed. But to use any ldap clients like ldapsearch or
> ldapmodify, I must specify "-Y GSSAPI" , else I get a "no mechanism
> available" error. Is this an "Identity Mapping" problem, an ldap.conf
> problem, or is it "as designed"?
>
OpenLDAP ldapsearch, ldapmodify, etc. (/usr/bin/ldapsearch etc.) attempt
to use SASL by default. If you use the -x argument, it will use simple
userDN/password bind.
> My ldap.conf man page says that "SASL_MECH" is a per-user setting in
> .ldaprc, so I worry that my services without a login will not use LDAP
> correctly.
> I read
> http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Introduction_to_SASL-SA
> SL_Identity_Mapping.html
> and the next section on "Realms" but the docs don't say if one should
> actually put "cn=gssapi,cn=auth" into the SASL map.
>
>
> Thanks!
>
>
> ***************************
> ***************************
> ***************************
> [installer at trixter ~]$ ldapsearch -V
> ldapsearch: @(#) $OpenLDAP: ldapsearch 2.3.34 (Nov 2 2007 08:16:21) $
>
> kojibuilder at xenbuilder2.fedora.redhat.com:/builddir/build/BUILD/openldap-2.3
> .34/openldap-2.3.34/build-clients/clients/tools
> (LDAP library: OpenLDAP 20333)
> SASL/EXTERNAL authentication started
> ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
> additional info: SASL(-4): no mechanism available:
>
> ***************************
> ***************************
> ***************************
> [installer at trixter ~]$ ldapsearch -V -Y GSSAPI > /dev/null
> ldapsearch: @(#) $OpenLDAP: ldapsearch 2.3.34 (Nov 2 2007 08:16:21) $
>
> kojibuilder at xenbuilder2.fedora.redhat.com:/builddir/build/BUILD/openldap-2.3
> .34/openldap-2.3.34/build-clients/clients/tools
> (LDAP library: OpenLDAP 20333)
> SASL/GSSAPI authentication started
> SASL username: installer at HYMESRUZICKA.ORG
> SASL SSF: 56
> SASL installing layers
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3245 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://listman.redhat.com/archives/fedora-directory-users/attachments/20080125/f0e7385d/attachment.bin>
More information about the Fedora-directory-users
mailing list