Harti Brandt wrote: > On Sun, 18 Jan 2009, Hartmut.Brandt_at_dlr.de wrote: > >> Hi, >> >> for a year or so I had nss_ldap connected to an active directory (with openldap23-sasl-client) on a year-old current. Yesterday I've rebuilt everything and I started to get 'undefined symbols' (for example gss_equal_oid) when running any program needing pw or group entries. After some poking around I fixed these by adding -lgssapi to the Makefiles for libgssapi_krb5.so and libgssap_spnego.so. Now getent, local login and everything works fine, except cron and sshd. Hi Harti, I'm setting up a -CURRENT vm right now with nss_ldap and have an LDAP server which requires SASL. I use a global krb5 credentials cache for nss_ldap as it appears you do. Last time I did this was right around the time the latest heimdal was imported. My setup worked before the import and broke afterwards. As I recall from talking to dfr_at_ (?) libgssapi_{krb5,spnego} are just plugins for libgssapi. They should not need to be linked against libgssapi and other things should not link against them. I would like to see this fixed as libgssapi is intended to be used. I just want to know what the proper fix is. (Hey, just found the old conversation with dfr_at_ in my inbox but need to read through the whole thing to figure out what's up.) >> >> Both create entries in /var/log/messages like: >> >> Jan 18 20:00:02 knopdnsimu13f cron[1495]: GSSAPI Error: Miscellaneous failure (see text)???????????????ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ Z > ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ >> Jan 18 20:00:02 knopdnsimu13f kernel: ZZZZZZZZZZZZZZZZ >> >> I've tried to figure out in which of the dozens of layered libraries (gss, sasl, ssl, ......) this error is generated but did not find anything. >> >> This is on amd64, krb5 enabled in pam, gssapi disabled in sshd_config (as I said, this worked before). > > So to answer my own mail: I made a link from the kerberos ticket file > which contains the host ticket (and is specified in nss_ldap.conf) to > /tmp/krb5cc_0. I've no idea why this is suddenly necessary, though. There may be an issue with the env method used in nss_ldap to change the credentials cache. My mind is fuzzy but I do recall a similar issue but don't remember the exact cause or case. nss_ldap has a second configurable ccname method which when I submitted the original patch I intended to switch to once we had a newer heimdal. Once I get nss_ldap working on my box I intend to submit another patch. tom -- | tmclaugh at sdf.lonestar.org tmclaugh at FreeBSD.org | | FreeBSD http://www.FreeBSD.org |Received on Thu Feb 26 2009 - 12:41:37 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:39:42 UTC