Cannot start kerberos signing/sealing when using TLS/SSL

I get the following error when I use LDAPS with SASL/GSSAPI authentication 
to Active Directory.  The error occurs because SASL/GSSAPI tries to encrypt 
the connection although SSL encryption is already used.  This can be 
disabled by setting the sasl security property maxssf to 0, but it seems not 
to work. Do I use it wrongly or is the value not passed through ?

Thank you
Markus

The error message I get is:

00002029: LdapErr: DSID-0C09016D, comment: Cannot start kerberos 
signing/sealing when using TLS/SSL, data 0, vece at ./LDAP-AD-query.pl

My perl script:

#!/usr/bin/perl
#
#   Reads LDAP Attributes
#
#
 use Net::LDAPS;
 use Authen::SASL qw(Perl);
# use Authen::SASL;
 use Authen::Krb5;
 use Net::DNS;

 my $user = 'mm';

 # DNS details
 my $ares = Net::DNS::Resolver->new;
 my $nres = Net::DNS::Resolver->new;
 my $rres = Net::DNS::Resolver->new;
 my $aquery = $ares->query("win2003r2.home");
 my $hostlist = '';

#
# Query DNS and make sanity checks to guaranty Kerberos works
#
 if ($aquery) {
   # loop over list of IP-addresses
   foreach my $arr ($aquery->answer) {
     next unless $arr->type eq "A";
     my $nquery = $nres->query($arr->address);
     if ($nquery) {
       # Get names for IP-addresses
       foreach my $nrr ($nquery->answer) {
         next unless $nrr->type eq "PTR";
         my $rquery = $rres->query($nrr->ptrdname);
         if ($rquery) {
           # Check if DNS lookup of name gives same IP-address
           foreach my $rrr ($rquery->answer) {
             next unless $rrr->type eq "A";
             if ( $rrr->address eq $arr->address ) {
               $hostlist = $hostlist." ".$nrr->ptrdname;
             }
           }
         }
       }
     }
   }
 } else {
     print("DNS query failed: $ares->errorstring \n");
     exit;
 }
 my @hosts = split(/\s+/,$hostlist);

 # ldap details
 my $server = \@hosts;
 my $bind_path = 'dc=win2003r2,dc=home';
 my ($mail, $samaccountname, $userprincipalname, $useraccountcontrol);
 my ($ldap, $sasl, $mesg, $entry);

#
# Connect to Global Catalog to get details of all trusted domain users
#
# $ldap = Net::LDAP->new( $server,
#                          port => 3268,

 $ldap = Net::LDAPS->new( $server,
                          port => 3269,
                          timeout => 2,
                          verify => 'never',
                          version => 3) or die "$@";


 # Setup Kerberos cache
 Authen::Krb5::init_context();
 my $ccache_name = "FILE:/tmp/.client.cache.$$";
 my $ccache = Authen::Krb5::cc_resolve($ccache_name);
 my $kt = Authen::Krb5::kt_resolve('FILE:./clienttest.keytab');
 my $princ = Authen::Krb5::parse_name('client/[email protected]');
 $ccache->initialize($princ);
 my $creds = Authen::Krb5::get_init_creds_keytab($princ, $kt);
 $ccache->store_cred($creds);

 $ENV{'KRB5CCNAME'} = $ccache_name;
 $sasl = Authen::SASL->new('GSSAPI', 'user' => '','maxssf' => 0 );
# $sasl = Authen::SASL->new('GSSAPI', 'user' => '''maxssf' => 0 , debug => 
13);
# $ldap->debug(15);
# $ldap->debug(255);
 $mesg = $ldap->bind( '',
                      sasl => $sasl) ;

 $mesg->code && die $mesg->error;

 $mesg = $ldap->search( # perform a search
                          base   => $bind_path,
                          filter => "(samaccountname=$user)",
                          timelimit => 2,
                          attrs => ['mail',
                                    'samaccountname',
                                    'useraccountcontrol',
                                    'userprincipalname']
                        );
 $ccache->destroy;

 $mesg->code && die $mesg->error;

 foreach $entry ($mesg->entries) {
     $mail = $entry->get_value('mail');
     $samaccountname= $entry->get_value('samaccountname');
     $useraccountcontrol = $entry->get_value('useraccountcontrol');
     $userprincipalname = $entry->get_value('userprincipalname');
   }

 $mesg = $ldap->unbind;  # take down session

 my $locked = ($useraccountcontrol & 0x0002)?"Yes":"No" if defined 
$useraccountcontrol;

 print("Retrieved LDAP  Attributes:\n");
 print("User-Mail = $mail\n");
 print("User-SAM-Accountname = $samaccountname\n");
 print("User-Account-Control = $useraccountcontrol\n");
 print("User-Account-Locked = $locked \n");
 print("User-Principal-name = $userprincipalname\n");