Re: SASL/GSSAPI authentication problems - Invalid credentials

[Quanah Gibson-Mount <quanah@stanford.edu>]

Ben,

We use SASL/GSSAPI with our OpenLDAP servers w/o problem.

I can give you the following suggestions:

Our /etc/init.d/slapd has:

#!/sbin/sh
KRB5_TKNAME="FILE:/etc/leland/krb5.keytab"
export KRB5_KTNAME

Our slapd.conf has:
sasl-realm	stanford.edu
sasl-host	<hostname>.stanford.edu
sasl-authz-policy	both
sasl-regexp uid=(.*),cn=stanford.edu,cn=gssapi,cn=auth 
uid=$1,cn=Accounts,dc=stanford,dc=edu

I suggest getting rid of the srvtab line, srvtab's are K4 identities, not 
K5.

In your slapd.acl file, try having:

access to dn.base=""
	by * read

access to attr=member
	by * compare

access to attr=entry
	by * read

access to dn,children="cn=person,ou=reed,dc=edu" attr=uid
	by * search (or read)

--Quanah

--
Quanah Gibson-Mount
Senior Systems Administrator
ITSS/TSS/Computing Systems
Stanford University
GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html