Re: ldapsearch with GSS-SPNEGO
Dan White <[email protected]>
| Newsgroups | gmane.comp.security.cyrus.sasl |
|---|---|
| Message-ID | <[email protected]> |
On 04/10/13 17:50 +0800, Cai Fa wrote: >Hi All, >I try to do ldapsearch an Active Directory by GSS-SPNEGO. >> ldapsearch -Y GSS-SPNEGO -LLL -s "base" -b "" supportedSASLMechanisms -h 10.155.60.241 -v > >But I got following error: >ldap_initialize( ldap://10.155.60.241 ) >SASL/GSS-SPNEGO authentication started >ldap_sasl_interactive_bind_s: More results to return (-15) > >It looks like there are some SASL steps need to do, but the client >return an error. > >Is there anyone can help me? >Thanks. My experience with GSS_SPNEGO is that it only works if the remote end is running OpenLDAP (or presumably any ldap server compiled against cyrus sasl), and only when the plugin is linked against the mit kerberos libraries (not heimdal). It does not work for me in any scenario where the remote end is an Active Directory server. Ken has said that GSS-SPNEGO is only intended for use with HTTP (cyrus imapd caldav support). -- Dan White