4

I am trying to setup & configure OpenLDAP on Fedora Core 13. I've gotten as far as compiling and installing OpenLDAP v2.4.23.

Whenever I try to run one of the LDAP commands (like ldapsearch), I get the following error message:

SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Local error (-2)
        additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Credentials cache file '/tmp/krb5cc_0' not found)

I looked up on this on Google and one solution seems to be configuring Kerberos to work properly first using kinit.

However, I do not want Kerberos on my system. Is it possible to make OpenLDAP not use Kerberos at all? Do I need to compile with a suitable option? Or is it that I MUST use Kerberos with OpenLDAP?

1
  • 1
    FWIW, GSSAPI is only one SASL mechanism. There are several others, including PLAIN. Feb 7, 2011 at 21:04

1 Answer 1

7

If you don't want to authenticate with Kerberos, you need to tell the OpenLDAP tools that by using the -x command line option. From the man page for ldapsearch:

       -x     Use simple authentication instead of SASL.

When using -x, you will also need -D, to specify your bind DN, and you will need to provide the password via either -W (to prompt for the password) or -y file to read the password from file.

3
  • Are there any appropriate syntax for ldap.conf, to make it default for every program? Feb 18, 2023 at 16:01
  • Looking at the docs for ldap.conf, I don't see anything that seems likely. I think "how to bind" is generally left up to the individual application.
    – larsks
    Feb 18, 2023 at 18:25
  • oook, moving from my old setup to new becoming quite interesting. I'd say it's becoming TOO interesting Feb 20, 2023 at 9:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .