Howard Chu
2008-Jan-25 20:21 UTC
Re: [Fedora-directory-users] ldap commands require "-Y GSSAPI". Fixable with "Identity Mapping" ?
> Date: Fri, 25 Jan 2008 12:57:55 -0700 > From: Rich Megginson<rmeggins@redhat.com>> Listbox wrote: >> Hi folks, >> >> I have sasl-gssapi installed. But to use any ldap clients like ldapsearch or >> ldapmodify, I must specify "-Y GSSAPI" , else I get a "no mechanism >> available" error. Is this an "Identity Mapping" problem, an ldap.conf >> problem, or is it "as designed"? >> > OpenLDAP ldapsearch, ldapmodify, etc. (/usr/bin/ldapsearch etc.) attempt > to use SASL by default. If you use the -x argument, it will use simple > userDN/password bind.It sounds like, since he went to the effort of installing sasl-gssapi, that he actually wants to use SASL Binds though. When no mechanism is specified, the client library tries to read the supportedSASLMechanisms attribute from the server''s rootDSE. If the rootDSE is unreadable (due to ACLs most likely) then you''ll get this type of failure.>> My ldap.conf man page says that "SASL_MECH" is a per-user setting in >> .ldaprc, so I worry that my services without a login will not use LDAP >> correctly. >> I read >> http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Introduction_to_SASL-SA >> SL_Identity_Mapping.html >> and the next section on "Realms" but the docs don''t say if one should >> actually put "cn=gssapi,cn=auth" into the SASL map.-- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/