  Re: Openldap, kerberos backend, and SASL  Da Rock wrote: On
Wed, 2009-03-04 at 17:27 -0800, Howard Chu wrote: You're missing
the obvious fact that GSSAPI/Kerberos is not the only secure
SASL mechanism available in this picture, and it is obviously
not the one the KDC uses to talk to LDAP.  I'm aware that SASL
GSSAPI is not the only SASL auth on offer, but I'm not sure of
the latter part of your statement: do you mean that the ldap
used as a backend cannot use the kdc using the ldap as the
backend for  The slapd can use SASL/Kerberos to authenticate
everyone *except* requests from the KDC itself, because that
would cause the chicken'n'egg loop that you already alluded to.
The Heimdal code always uses SASL/EXTERNAL to talk to ldap, for
this very reason.  You have awoken an alternative in my mind,
though. I'll just go and stick my head back in my Openldap doc
under SASL for a bit- I'll probably come back with another
stupid question shortly... :)  A couple of points of interest
come to mind:  1. Security of th