Re: SASL authentication

Rich Megginson wrote:
> Xu, Qiang (FXSGSC) wrote:
>>> Rich Megginson wrote:
>>> When you use something like ldapsearch -Y GSSAPI, the
>>> kerberos implementation will see if you have a cc, and by
>>> default it will look in /tmp/krb5cc_UID to get them, and use
>>> them to authenticate.
>>
>> From your description, it sounds that LDAP client such as ldapsearch
>> can pick up the Kerberos TGT automatically, right? If the answer is
>> yes, then I would not have to worry about how to fetch the ticket from
>> Kerberos authentication.
> 
> Yes.

mozldap's ldapsearch obtains a TGT without a kinit invoked before? For
sure it will obtain a session ticket (ST). But does it also something
like kinit internally?

Ciao, Michael.