Re: LDAP + Kerberos not allowing simple binds

["Robert" <Robertedstrom@yahoo.com>]

"Jose Gonzalez Gomez" <jgonzalez@opentechnet.com> wrote in message
411E7C85.2090002@opentechnet.com">news:411E7C85.2090002@opentechnet.com...
> Robert wrote:
>
> >
>     Then you should make that work before trying to use the {SASL} in
> userPassword. Have you taken a look at log files? I think you may run
> saslauthd with some verbose flag (-v?) so you may see the result of the
> authentication attempt. You may also look at the log files generated by
> sasl to see the cause of failed authentications.
>

The message generated by saslauthd looks like:

saslauthd[816]: do_auth         : auth failure: [user=user] [service=ldap]
[realm=DOMAIN.REALM] [mech=kerberos5] [reason=saslauthd internal error]

I have added the host/fully.qualified.domain-name and
ldap/fully.qualified.domain-name to both the system keytab, /etc/krb5.keytab
and the /etc/openldap/ldap.keytab files.  There is a file
/usr/local/lib/sasl2/slapd.conf which contains:

pwcheck_method: saslauthd
keytab: /etc/openldap/ldap.keytab
saslauthd_path: /var/run/saslauthd/mux

The strange thing is that if I supply the wrong password, testsaslauthd or
simple binding to the ldap directory fails immediately.  If I supply the
correct password for the principal, the verification process stalls for a
couple seconds, then it returns failure.  Another thing is that when I
supply the correct the correct dn and password, there is a credentials cache
/ ticket file in the temp directory.  The kdc log also shows that it issued
a ticket for the user but the authentication still fails.

I have googled away and found this exact issue and it was solved.  I can't
seem to get it solved on my end.  Anything that I missed?

Thanks.
Robert