I am integrating openldap with MIT kerberos and have couple of questions regarding that.

I was able to do this integration and kerberos services only starting with

ldap_kerberos_container_dn = cn=kerberos,dc=myldap,dc=com

but when I use ou [ldap_kerberos_container_dn = ou=kerberos, dc=myldap, dc=com], it does not automatically create any entry in openldap but with cn it does. Also with ou=kerberos, if I manually add an ou=kerberos then I can see kerberos defaults entries in opendap in the ou.

Can someone explain why this is so? Will it have an impact if I go with ou rather than cn?


While doing kadmin.local I am getting error for insufficient privileges.

add_principal: Principal add failed: Insufficient access while creating "anwaar@EXAMPLE.COM

I know this is because in my openLDAP, the ldap_kadmind_dn have no write privileges on realm EXAMPLE.COM inside the kerberos container. I have done the setup using online open ldap not slapd.conf file , so please let me know how can I grant write privileges to it.

require info:- from /etc/krb5.conf

ldap_kadmind_dn = cn=krbadmin, ou=people, dc=myldap, dc=com

I tried to add the oclAccess like below using and LDIF but getting error:-

dn: olcDatabase={2}bdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to dn.subtree="cn=EXAMPLE.COM,cn=kerberos,dc=myldap,dc=com" by
  dn="cn=krbadmin,ou=people,dc=myldap,dc=com" write by anonymous auth by self write by * none

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.