Re: LDAP config problem with GSSAPI: No such file or directory

[Buchan Milne <bgmilne@staff.telkomsa.net>]

On Wednesday 16 January 2008 20:15:36 Listbox wrote:
> Yes, I can kinit,
> I already tried making /etc/krb5.keytab world readable, it did not change
> the "No such file" error. However, should it be owned by root or my slapd
> user?
> [root@trixter ~]# ll /etc/krb5.keytab
> -rw-r--r-- 1 root root 712 2008-01-15 13:00 /etc/krb5.keytab
>
> The logs I check are /var/log/messages  slapd and krb5kdc.log. The logs do
> not show the ldap client error. I DID see some SELINUX errors for
> krb5kdc_rcache and krb5.conf, but I ran restorecon and fixed those. This
> did not stop the error. I guess I'll try turning SELINUX off, and see if
> that makes any difference.
>
> BTW: Here's the command with debug on:
>
> [installer@trixter ~]$  ldapwhoami -V -d 1 -Y GSSAPI
> ldapwhoami: @(#) $OpenLDAP: ldapwhoami 2.3.34 (Nov  2 2007 08:16:20) $
>
> kojibuilder@xenbuilder2.fedora.redhat.com:/builddir/build/BUILD/openldap-2.
>3 .34/openldap-2.3.34/build-clients/clients/tools
>         (LDAP library: OpenLDAP 20333)

[...]

> ldap_sasl_interactive_bind_s: Invalid credentials (49)
>         additional info: SASL(-1): generic failure: GSSAPI Error:
> Unspecified GSS failure.  Minor code may provide more information (No such
> file or directory)

The "Minor code" error message comes from the GSSAPI layer, the best place to 
look for information on this is in your kdc log file. While you won't see a 
client error, you may see requests for unexpected tickets etc., which would 
require you to fix configuration of non-LDAP issues (e.g. reverse DNS lookups 
etc.).

Regards,
Buchan