22.3 Error Messages

SASL-GSSAPI: Reading Object user_FDN FAILED eDirectory error code

Cause: This error is generated in eDirectory. The user_FDN object does not exist.

SASL-GSSAPI: Reading principal names for user_FDN failed eDirectory error code

Cause: This error is generated in eDirectory. The Kerberos principal name is not attached to the user object (userdn).

SASL-GSSAPI: Reading Object Realm_FDN FAILED eDirectory error code

Cause: This error is generated in eDirectory. The realm object does not exist.

SASL-GSSAPI: Not enough memory

Cause: Not enough memory to perform the specific operation.

SASL-GSSAPI: Invalid Input Token

Cause: Token from client is defective or invalid

SASL-GSSAPI: NMAS error NMAS error code

Cause: This error is generated in NMAS and is an internal error.

SASL-GSS: Invalid LDAP service principal name LDAP_service_principal_name

Cause: The LDAP service principal name is invalid.

SASL-GSS: Reading LDAP service principal key from eDirectory failed

Cause: The LDAP service principal object is not created.

Cause: The realm object’s master key is changed.

Cause: The LDAP service principal object was not found in the subtree of the realm to which it belongs.

SASL-GSS: Creating GSS context failed

Cause: The time is not in sync between the client, KDC and the eDirectory servers.

Cause: The key of the LDAP service principal was changed in the Kerberos database, but not updated in eDirectory.

Cause: The encryption type is not supported.

SASL GSSAPI: Invalid user FDN = user_FDN

Cause: The user FDN provided by the client is not valid.

SASL GSSAPI: No user DN is associated with principal client_principal_name

Cause: A user object under the subtree is not attached with the Kerberos principal name.

SASL GSSAPI: More than one user DN is associated with principal client_principal_name

Cause: More than one user object under the subtree is associated with the same principal.

ldap_simple_bind_s: Invalid credentials major = 1, minor =0

Cause: The cause might be the version mismatch between the LDAP service principal on the KDC server and the LDAP service principal on the eDirectory server. This is because every time you extract the LDAP service principal key to the keytab file, the key version number gets incremented.

Action:

Complete the following procedure:

  1. Update the key in eDirectory server so that the version numbers are in sync.

  2. Destroy the tickets at the client.

  3. Get the TGT again for the principal.

  4. Perform the LDAP sasl bind operation.