Kerberos/SASSL/OpenLDAP : GSSAPI Error: Unspecified GSS failure. Minor code may provide more information ()

Question

I'm setting up openLDAP with SASL authentification with kerberos. I got problem with this auth.

First, I get the kerberos ticket with kinit. When I make a klist, the ticket is displayed. So, no problem. But when I try to make ldapwhoami. I got an error :

[hue@sandbox ~]$ kdestroy

[hue@sandbox ~]$ kinit vishnu
Password for [email protected]:

[hue@sandbox ~]$ klist
Ticket cache: _FILE:/tmp/krb5cc_1007
Default principal: [email protected]

Valid starting     Expires            Service principal
05/29/14 06:42:52  05/29/14 16:42:52  krbtgt/[email protected]
        renew until 06/05/14 06:42:48
05/29/14 06:42:57  05/29/14 16:42:52  ldap/[email protected]
        renew until 06/05/14 06:42:48

[hue@sandbox ~]$ ldapwhoami
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80)
        additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information ()

I don't know where to search anymore. Please, help me.

Vicegerent

Answer 1

I had the same error message with the missing minor code. While searching for people with similar problems I noticed that this usually has something to do with an inaccessible keytab file.

In my case the problem was the group of the /etc/openldap/ldap.keytab file was root instead of ldap. Other possible problems can be a wrong or missing KRB5_KTNAME path in your slapd options file (/etc/sysconfig/ldap on red hat 6)

Flemish

I'm sure that I had access to the keytab because I used chmod 777... And I also well specified the path to the keytab. Thanks anyway for your reply ! – Vicegerent

Sometimes that's the problem, I don't know in this case in particularly, but sometimes the keytab file has to have 644 permission or whatever thing it is reading it won't recognize it. – Cordon

to be more precise about my last comment, check here: blog.scottlowe.org/2006/08/10/kerberos-based-sso-with-apache it says permissions 400. – Cordon