Zurück
-
Titel
ldapsearch command is unable to perform LDAP queries against vasproxy -
Beschreibung
After setting up vasproxy on a system the ldapsearch command is unable to perform LDAP queries. The following error message is reported:
# ldapsearch -x -h 127.0.0.1:10000 -b "dc=domain,dc=com"Failed to obtain a bound LDAP handle, error(2): VAS_ERR_KRB5: Kerberos errorRequested service (ldap/127.0.0.1@DOMAIN.COM) cannot be found.Caused by:KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN (-1765328377): Server not found in Kerberos databaseReason: Server (ldap/127.0.0.1@DOMAIN.COM) unknown -
Ursache
The version of ldapsearch that comes with QAS (/opt/quest/bin/ldapsearch) does not work with vasproxy. The vasproxy daemon does not support gssapi authentication, it only provides v2 anon access, while the version of ldapsearch that comes with QAS supports only gssapi authentication. -
Lösung
The standard OpenLDAP version of ldapsearch that is available from most distributions supports the anon access that is required to query against vasproxy and so this version should be used instead.