Re: GSSAPI and LVS Load balanced ldap servers

[Simon Wilkinson <simon@sxw.org.uk>]

On 3 Feb 2009, at 01:31, Frank Swasey wrote:
> Yeah, that's my guess too of the current failure.

The problem is that both the client and the server must have a  
matching idea of the service principal to use in establishing the  
GSSAPI connection.

The client will use ldap/ldap.uvm.edu, as that's the only name it  
knows the server by. However, the server will end up using ldap/ 
hostname() and therefore the two won't match, and you'll get these  
errors.

There is a work around for this at the GSSAPI layer, which is to tell  
the server to trust any principal that exists in the service's keytab.  
Unfortunately, Cyrus SASL doesn't seem to expose a mechanism for doing  
this, and so the only way to do so is via a code change to the SASL  
library.

S.