Re: ldapsearch fail after realm trust exchange from OpenLDAP to A.Don Win 2003 SP2

[Howard Chu <hyc@highlandsun.com>]

Comisario, Alejandro wrote:
> Hi everybody.
> I'm trying to establish a trust mechanism between openLDAP (v2.3 on Debian
> Etch Stable) and A.D ( Win.2003 SP2 ) for a referral to work.
> I'll pass some useful information to understand better the
> situation/problem.

> - OpenLDAP is working fine against heimdal via GSSAPI. My configuration is
> this (I've truncated relevant information, I think)

> doldap@root # ldapsearch -H ldap://kerberos.openldap.sc -b
> "cn=admin,dc=siscat,dc=com" -LLL
> SASL/GSSAPI authentication started
> SASL username: usuprueba@OPENLDAP.SC
> SASL SSF: 56
> SASL installing layers
> dn: cn=admin,dc=siscat,dc=com
> objectClass: simpleSecurityObject
> objectClass: organizationalRole
> cn: admin
> description: LDAP administrator
> userPassword:: XXXXXXXXXXXXXXXXX

> The information/error I get is this one.
> (I think it's important to say that I've fixed the issue of encryption not
> supported)
> 
> SASL/GSSAPI authentication started
> SASL username: usuprueba@OPENLDAP.SC
> SASL SSF: 56
> SASL installing layers
> Operations error (1)
> Additional information: 00000000: LdapErr: DSID-0C090627, comment: In order
> to perform this operation a successful bind must be completed on the
> connection., data 0, vece

OpenLDAP's command line tools only do referral chasing anonymously. AD requires 
an LDAP Bind operation to be performed for this particular request to succeed. 
You'll have to write some code for your own Rebind function to make this work.

-- 
   -- Howard Chu
   Chief Architect, Symas Corp.  http://www.symas.com
   Director, Highland Sun        http://highlandsun.com/hyc/
   Chief Architect, OpenLDAP     http://www.openldap.org/project/