Re: SASL authentication

Xu, Qiang (FXSGSC) wrote:
> Hi, all: 
> 
> Now the error of "86 Unknown authentication method" is gone. But a new error pops up: 
> ==============================================
> <apManager> (Fri Mar 13 2009 13:34:19.846) <p8124,t3078597536,aba_ldap_interface.c,2373>
>      INFO>> SASL Login
> <apManager> (Fri Mar 13 2009 13:35:07.089) <p8124,t3078597536,aba_ldap_interface.c,2388>
>      INFO>> SASL LDAP BIND with GSSAPI: Value of ldapStatus 82
> <apManager> (Fri Mar 13 2009 13:35:07.089) <p8124,t3078597536,aba_ldap_interface.c,2459>
>     ERROR>> LDAP BIND: Value of ldap failure status and text 82 Local error
> ==============================================
> What does this "local error" with the function ldap_sasl_interactive_bind_ext_s() mean? 

I'm not really sure.

> 
> Fortunately, I found some info about this error at http://aput.net/~jheiss/krbldap/howto.html:
> ==============================================
> ldap_sasl_interactive_bind_s: Local error 
> ldap/hostname service principal not set up 
> or your Kerberos ticket is expired 
> ==============================================
> Using klist, it is verified that a Kerberos ticket exists and has not expired. So does it mean the service principal is not set up? What is a service principle? I don't have any knowledge about it at all. Please shed some light on it, and give me some suggestions to set it up.

Well, your ldap server must have assigned a keytab from your kerberos KDC.

> 
> And how come it taks nearly 1 min to get this error from SASL2 library? Incredibly long.

I don't know.

> 
> Looking forward to help,
> Xu Qiang
>