To Configure the GSSAPI Mechanism

The following procedure explains how to configure Directory Server to use GSSAPI on the Solaris OS:

You cannot use DSCC to perform this task. Use the command line, as described in this procedure.

1. Create the default identity mapping for GSSAPI and any custom mappings as described in GSSAPI Identity Mappings.

2. Create a keytab to store the service keys.

   Your LDAP service key is stored in the keytab.

   1. Ensure that the keytab is only readable by the Directory Server user.

   2. Change the file name to be different from the default /etc/krb5/krb5.keytab.

   3. Set the environment variable KRB5_KTNAME to ensure that the new keytab is used rather than the default keytab.

3. If you modified the SASL configuration entry or one of the GSSAPI identity mapping entries, restart Directory Server.

   Note that the DNS must be configured on the host machine.