Re: Questions on openldap and kerberos....

2013-01-07 Thread John Tobin
> Le Mon, 7 Jan 2013 13:04:54 -0500, > John Tobin a écrit : > >> The kdc, and this client [the ldapsearch] are both on the same >> machine. I assume both of these processes get their clock reading >> from a 'date' type function off of the [same] machine... How can one >> skew from the other? It's

Re: Questions on openldap and kerberos....

2013-01-07 Thread Jean-Christophe Gay
Le Mon, 7 Jan 2013 13:04:54 -0500, John Tobin a écrit : > The kdc, and this client [the ldapsearch] are both on the same > machine. I assume both of these processes get their clock reading > from a 'date' type function off of the [same] machine... How can one > skew from the other? It's the same

Re: Questions on openldap and kerberos....

2013-01-07 Thread Russ Allbery
John Tobin writes: > The kdc, and this client [the ldapsearch] are both on the same machine. > I assume both of these processes get their clock reading from a 'date' > type function off of the [same] machine... How can one skew from the > other? It's the same clock Hm. Is the LDAP server al

Re: Questions on openldap and kerberos....

2013-01-07 Thread John Tobin
The kdc, and this client [the ldapsearch] are both on the same machine. I assume both of these processes get their clock reading from a 'date' type function off of the [same] machine... How can one skew from the other? It's the same clock tob On 1/7/13 12:45 PM, "Russ Allbery" wrote: > Joh

Re: Questions on openldap and kerberos....

2013-01-07 Thread Russ Allbery
John Tobin writes: > On the other hand the test put forward with the ldapsearch is running as > a client on the server machine. It's just one machine, so how does > that work? How can I get different times when the client and server are > on the same machine? I would be assuming that the loca

Re: Questions on openldap and kerberos....

2013-01-07 Thread John Tobin
Very sorry, You are absolutely correct, I read the first part [SASL(-1): generic failure: GSSAPI error:] Which is identical to the failure before, and assumed the same failure My mistake On the other hand the test put forward with the ldapsearch is running as a client on the server machin

Re: Questions on openldap and kerberos....

2013-01-07 Thread Roland C. Dowdeswell
On Mon, Jan 07, 2013 at 10:23:57AM -0500, John Tobin wrote: > > As a rookie, I hadn't considered...this is an absolutely excellent > suggestion. See below, it didn't change anything. > I was running as root... Do I need to create a principal for the id 'root', > or can I use the base id [in this c

Re: Questions on openldap and kerberos....

2013-01-07 Thread John Tobin
As a rookie, I hadn't considered...this is an absolutely excellent suggestion. See below, it didn't change anything. I was running as root... Do I need to create a principal for the id 'root', or can I use the base id [in this case jctobin] as a ticket for root? tob kerberos1:/etc/init.d # kadmin

Re: Questions on openldap and kerberos....

2013-01-04 Thread Greg Hudson
On 01/04/2013 04:31 PM, John Tobin wrote: > kerberos1:~ # ldapsearch -h kerberos1.dark1.net -b 'dc=dark1,dc=net' > '(uid=jtobin)' > SASL/GSSAPI authentication started > ldap_sasl_interactive_bind_s: Local error (-2) > additional info: SASL(-1): generic failure: GSSAPI Error: > Unspecified

Questions on openldap and kerberos....

2013-01-04 Thread John Tobin
Dear Kerveros, Please inform me if this is inappropriate for the kerberos forum, I understand this is probably a user bug... I have looked under a number of different pieces of documentation, I am probably looking in the wrong places. Assistance is requested from those who may be able to provide g