[19660] in Kerberos_V5_Development
KDC with LDAP backend can't add principal
daemon@ATHENA.MIT.EDU (Micro dong)
Wed Sep 20 10:46:26 2017
MIME-Version: 1.0
From: Micro dong <microle.dong@gmail.com>
Date: Wed, 20 Sep 2017 17:59:03 +0800
Message-ID: <CAHSBsBPA8688Qzrydp8g3t0Ue=NMuRNjtbuLPWahSNF2yvBAog@mail.gmail.com>
To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
Hi,
I am trying to install a KDC with an OpenLDAP backend, following
instructions found on the MIT kerberos site. Installation went fine and I
can see that the default principals have been created.
However, I cannot add new principals :
kadmin.local -q "addprinc -randkey test001"
Authenticating as principal root/admin@HADOOP.COM with password.
WARNING: no policy specified for test001@HADOOP.COM; defaulting to no policy
add_principal: Principal add failed: Insufficient access while
creating "test001@HADOOP.COM".
And my acl in openldap is:
access to dn.base=""
by * read
access to dn.base="cn=Subschema"
by * read
access to attrs=userPassword,userPKCS12
by self write
by * auth
access to attrs=shadowLastChange
by self write
by * read
# Providing access to realm container
access to dn.subtree="cn=HADOOP.COM,cn=kerberos,dc=xitong,dc=qh,dc=com"
by dn.exact="uid=krb5kdc,cn=krbcontainer,dc=xitong,dc=qh,dc=com" write
by dn.exact="uid=kadmind,cn=krbcontainer,dc=xitong,dc=qh,dc=com" write
by * none
access to *
by * read
Any help would be highly appreciated.
*Best regards*
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
