<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div><div>With OpenLDAP you solve this by using an ssl cert with Alternative names on each server – and you use the sasl-host parameter to tell OpenLDAP to use that common name between the various certs on the actual LDAP servers. How you duplicate that in AD is left to the reader…</div><div><br></div><div><div id="MAC_OUTLOOK_SIGNATURE"><div>—</div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">Frank Swasey</font></font></div><div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><font class="Apple-style-span" color="#000000"><font class="Apple-style-span" face="Calibri">Systems Architecture & Administration</font></font></div></div></div></div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:12pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> Cyrus-sasl <<a href="mailto:cyrus-sasl-bounces+frank.swasey=uvm.edu@lists.andrew.cmu.edu">cyrus-sasl-bounces+frank.swasey=uvm.edu@lists.andrew.cmu.edu</a>> on behalf of Tadashi Inayama via Cyrus-sasl <<a href="mailto:cyrus-sasl@lists.andrew.cmu.edu">cyrus-sasl@lists.andrew.cmu.edu</a>><br><span style="font-weight:bold">Reply-To: </span> Tadashi Inayama <<a href="mailto:tci@qad.com">tci@qad.com</a>><br><span style="font-weight:bold">Date: </span> Friday, February 12, 2016 at 5:10 PM<br><span style="font-weight:bold">To: </span> "<a href="mailto:cyrus-sasl@lists.andrew.cmu.edu">cyrus-sasl@lists.andrew.cmu.edu</a>" <<a href="mailto:cyrus-sasl@lists.andrew.cmu.edu">cyrus-sasl@lists.andrew.cmu.edu</a>><br><span style="font-weight:bold">Subject: </span> Load-balancing LDAP using GSSAPI/Kerberos/Cryus-SASL<br></div><div><br></div><blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;"><div><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><div><div dir="ltr">Hello,
<div><br></div><div>I am new to using GSSAPI/Kerberos/SASL but we got it working for authorization for LDAP queries from RHEL 5.11 and RHEL 6.7 clients against Win2k12 R2 Domain Controllers.</div><div><br></div><div>But when we try to load balance the LDAP traffic with F5 LTM (with <a href="http://dc1.test.com">
dc1.test.com</a> and <a href="http://dc2.test.com">dc2.test.com</a> as the pool members), ldapsearch via gssapi works half the time, and the other half we get an error that the message is changed mid-stream. We are guessing that Cyrus-SASL does a reverse dns
lookup of the domain controllers as a final check, and if the ip address of the domain controller does not match the hostname of the F5 Virtual Server then the error pops back as message changed mid-stream. So it work half of the time.</div><div><br></div><div>So we did some googling and came across this post:</div><div><br></div><div><a href="http://www.openldap.org/lists/openldap-software/200902/msg00019.html">http://www.openldap.org/lists/openldap-software/200902/msg00019.html</a><br></div><div><br></div><div>"<span style="color:rgb(0,0,0);font-family:monospace;font-size:medium">There is a work around for this at the GSSAPI layer, which is to tell the server to trust any principal that exists in the service's keytab. Unfortunately, Cyrus SASL doesn't seem to
expose a mechanism for doing this, and so the only way to do so is via a code change to the SASL library."</span></div><div><br></div><div>This post was from 2009. So is there currently a mechanism in Cyrus SASL to trust the principals whose key exists in the krb5.keytab? Or is there some established method to load balance between two MS Domain Controllers?</div><div><br></div><div>(The reason we are trying to load balance the ldap queries is so that when we perform patch or other maintenance work on the individual domain controllers, we don't break the authentication/authorization on the RHEL servers. Without load balancing, we
will need to change the authentication server entries on krb5.conf and sssd.conf in each of the RHEL servers. And we already have dns, ntp, and kerberos load-balancing using the F5, we just need to get the ldap portion completed.)</div><div><br></div><div>Thank you very much,</div><div>Tadashi</div><div><br></div><div><br></div><div><a href="http://dc1.test.com">dc1.test.com</a> <a href="http://dc2.test.com">
dc2.test.com</a> (Windows Domain Controllers)</div><div> \ /</div><div> \ /</div><div> \ /</div><div> \ /</div><div> <a href="http://ldap.test.com">ldap.test.com</a> (virtual server on F5 LTM)</div><div> |</div><div> |</div><div> |</div><div> <a href="http://linux_client.test.com">linux_client.test.com</a></div><div><br></div></div></div></div></blockquote></span></body></html>