Re: bind to LDAP server produces "invalid credentials" error

From	"Greg Hudson" <ghudson@mit.edu>
Newsgroups	comp.protocols.kerberos
Subject	Re: bind to LDAP server produces "invalid credentials" error
Date	2025-08-21 13:56 -0400
Organization	TNet Consulting
Message-ID	<mailman.212.1755798994.2322.kerberos@mit.edu> (permalink)
References	<CAFk47JhihapGzET44=pOcnfpjoBy8g-EK_X_1VYggNYxK=beKg@mail.gmail.com> <2696e2f7-43be-4745-843f-f0264769b263@mit.edu>

Show all headers | View raw

On 8/20/25 23:43, Travis Bean wrote:
> “Cannot bind to LDAP server ldapi:/// as
> ‘cn=kdc-srv,cn=krbContainer,dc=example,dc=local’: Invalid credentials
> - while initializing database.”

This means libkdb_ldap called ldap_sasl_bind_s() and got back an 
LDAP_INVALID_CREDENTIALS response, most likely indicating that the LDAP 
server didn't match the password from the service stash file.

I looked at the script you linked and didn't find any obvious problems, 
but there might be more information in the slapd log.  My next step 
after that would be to use gdb to debug through first the MIT krb5 side 
(making sure it read the expected password) and then slapd, after 
building both components from source with -g and no -O option.  It may 
be easier to debug the MIT krb5 side if you can reproduce the problem 
with kadmin.local.

Back to comp.protocols.kerberos | Previous | Next | Find similar

Thread

Re: bind to LDAP server produces "invalid credentials" error "Greg Hudson" <ghudson@mit.edu> - 2025-08-21 13:56 -0400

csiph-web