custom hostname for openldap/sasl is not working

[Zaar Hai <haizaar@haizaar.com>]

Good day, dear list!

I'm trying to setup SASL GSSAPI authentication for openldap that
listens on hostname different from the machine hostname it runs on.

openldap runs on server inka.example.com. ldap/inka/example.com
principal is added to ldap's keytab file. This command works just
fine:
  ldapsearch -Y GSSAPI -H 'ldap://inka.example.com'

Now:
 * I've added second IP to the inka.example.com
 * Added A record for ldap.example.com to point to that IP and setup
corresponding PTR record.
 * Created ldap/ldap.example.com principal and added it ldap's keytab.
 * Even set openldap to listen only on ldap.example.com IP.

But the command
  ldapsearch -Y GSSAPI -H 'ldap://ldap.example.com'
fails with the following error in ldap log: GSSAPI Error: Unspecified
GSS failure.  Minor code may provide more information (Wrong principal
in request)

I see that client successfully obtains ticket for
ldap/ldap.example.com@EXAMPLE.COM
I've tried to set sasl-host to ldap.example.com and sasl-realm to
EXAMPLE.COM in slapd.conf - did not help.
I've even tried to do "hostname ldap" on inka.example.com and restart
slapd - same error.
>From what I understand,  the slapd daemon will try, before connecting
the KDC server, to read the keytab file and get the key of the
principal ldap/<sasl-host>#<sasl-realm>, so it looks like I'm doing
the right thing, but it does not work.

System:
Debian testing.
slapd-2.4.17-2.1
sasl-2.1.23.dfsg1-5
MIT kerberos 1.8.3+dfsg~beta1-1

Thank you in advance for help,
--
Zaar



-- 
Zaar