Using StartTLS with LDAP Kerberos database

[povder]

Hi all

I'm trying to configure Kerberos to use LDAP database. My LDAP server
(OpenLDAP) is set to require TLS to bind and is configured to support
StartTLS on standard 389 port. When I try to start Kerberos KDC
service I'm getting "Confidentiality required" error in logs which is
a standard LDAP error when client tries to bind without TLS. When I
allow non-TLS binds on LDAP server everything works fine.

Is there a way to force Kerberos to use StartTLS?

Cheers
povder

[Greg Hudson]

Post by povder
Is there a way to force Kerberos to use StartTLS?

Not at the moment. We have a pending patch to add SASL support to our
LDAP KDB module, which also adds starttls support, but it needs some work.

You can use SSL (on a separate port, typically 636) using an ldaps: URI.