OS authentication with ldap

Products

• CA API Gateway

Issue/Introduction

Trying to get OS authentication setup with kerberos on new version 11 appliances.

I've created a bind account and keytab as indicated, but I get the errors below.

I obtained a packet trace, and I don't see a bind attempt.

Is there some way to figure out exactly why authentication is failing? The packet trace shows a single query and response, followed by an unbind. I'll attach the packet trace in case that's useful. 

(2023-07-20 16:38:06): [be[ldap]] [sasl_bind_send] (0x0020): ldap_sasl_interactive_bind_s failed (-2)[Local error]
(2023-07-20 16:38:06): [be[ldap]] [sdap_cli_connect_recv] (0x0040): Unable to establish connection [1432158227]: Authentication Failed

Environment

Release : 11.0

Cause

Kerberos needs to do a forward and reverse lookup of hostname to ip / ip to hostname 

Using the AD load balancer name in sssd.conf result in the lookup failing 

ad_server =  <AD_Load_Balancer>

(2023-08-10 10:54:52): [be[ldap]] [be_resolve_server_process] (0x0200): Found address for server <HostName>: [<IP_Address1>] TTL 900

The reverse lookup for <IP_Address1> is not <AD_Load_Balancer>, but a actual AD server (KDC) 

 

Resolution

For Kerberos forward/reverse lookup is required 

Step1 query DNS/KDC to get a list of servers 

NSLOOKUP on the Kerberos service provides all the IP and hostname 

 # nslookup -type=srv _kerberos._tcp.<DOMAIN_NAME>
Server:         <IP_ADDRESS>
Address:        <IP_ADDRESS>

_kerberos._tcp.<DOMAIN_NAME>  service = 0 100 88 server1.<Domain_Name>.
_kerberos._tcp.<DOMAIN_NAME>  service = 0 100 88 server2.<Domain_Name>.
_kerberos._tcp.<DOMAIN_NAME>  service = 0 100 88 server3.<Domain_Name>.
_kerberos._tcp.<DOMAIN_NAME>  service = 0 100 88 server4.<Domain_Name>.
_kerberos._tcp.<DOMAIN_NAME>  service = 0 100 88 server5.<Domain_Name>.
_kerberos._tcp.<DOMAIN_NAME>  service = 0 100 88 server6.<Domain_Name>.

Changed the sssd.conf

ad_server =  server1.<Domain_Name>