Re: Questions on openldap and kerberos....

2013-01-07 Thread John Tobin
As a rookie, I hadn't considered...this is an absolutely excellent suggestion. See below, it didn't change anything. I was running as root... Do I need to create a principal for the id 'root', or can I use the base id [in this case jctobin] as a ticket for root? tob kerberos1:/etc/init.d #

Re: Questions on openldap and kerberos....

2013-01-07 Thread Roland C. Dowdeswell
On Mon, Jan 07, 2013 at 10:23:57AM -0500, John Tobin wrote: As a rookie, I hadn't considered...this is an absolutely excellent suggestion. See below, it didn't change anything. I was running as root... Do I need to create a principal for the id 'root', or can I use the base id [in this case

Re: Questions on openldap and kerberos....

2013-01-07 Thread John Tobin
Very sorry, You are absolutely correct, I read the first part [SASL(-1): generic failure: GSSAPI error:] Which is identical to the failure before, and assumed the same failure My mistake On the other hand the test put forward with the ldapsearch is running as a client on the server

Re: Questions on openldap and kerberos....

2013-01-07 Thread Russ Allbery
John Tobin jto...@po-box.esu.edu writes: On the other hand the test put forward with the ldapsearch is running as a client on the server machine. It's just one machine, so how does that work? How can I get different times when the client and server are on the same machine? I would be

Re: Questions on openldap and kerberos....

2013-01-07 Thread John Tobin
The kdc, and this client [the ldapsearch] are both on the same machine. I assume both of these processes get their clock reading from a 'date' type function off of the [same] machine... How can one skew from the other? It's the same clock tob On 1/7/13 12:45 PM, Russ Allbery

Re: Questions on openldap and kerberos....

2013-01-07 Thread Russ Allbery
John Tobin jto...@po-box.esu.edu writes: The kdc, and this client [the ldapsearch] are both on the same machine. I assume both of these processes get their clock reading from a 'date' type function off of the [same] machine... How can one skew from the other? It's the same clock Hm. Is

Re: Questions on openldap and kerberos....

2013-01-07 Thread Jean-Christophe Gay
Le Mon, 7 Jan 2013 13:04:54 -0500, John Tobin jto...@po-box.esu.edu a écrit : The kdc, and this client [the ldapsearch] are both on the same machine. I assume both of these processes get their clock reading from a 'date' type function off of the [same] machine... How can one skew from the