So... fix that. Get TLS transport working first with ldapsearch. Then, use the same configuration for FreeRADIUS.
Another way is when I use GSSAPI, not TLS.
kinit admin
ldapsearch -b "dc=ad, dc=ourdomain, dc=hu" -H ldap://localhost -s sub "( samaccountname=admin)" -Y GSSAPI It works. I read a little about it, but I don't know, what I should configure for it. I set KRB5_CLIENT_KTNAME = /tmp/xyz (can I set it freely?) realm = 'AD.OURDOMAIN.HU'
That's all ldap magic. We didn't write OpenLDAP or ldapsearch, so our help here is limited.
I mean: I set KRB5_CLIENT_KTNAME and realm in the ldap module. Other changes in the ldap module: identity = 'cn=Administrator,cn=Users,dc=ad,dc=ourdomain,dc=hu' password=… base_dn = 'dc=ad,dc=ourdomain,dc=hu' realm { mech = 'GSSAPI' KRB5_CLIENT_KTNAME = /tmp/freeradius_ktab realm = 'ad.ourdomain.hu' } Debug output: Wed May 5 16:06:54 2021 : Debug: rlm_ldap (ldap): Connecting to ldap://localhost:389 Wed May 5 16:06:54 2021 : Debug: rlm_ldap (ldap): New libldap handle 0x5603f6c668b0 Wed May 5 16:06:54 2021 : Debug: rlm_ldap (ldap): Starting SASL mech(s): GSSAPI SASL/GSSAPI authentication started Wed May 5 16:06:54 2021 : Debug: rlm_ldap (ldap): SASL challenge : Authorization Name Wed May 5 16:06:54 2021 : Debug: rlm_ldap (ldap): SASL prompt : Please enter your authorization name Wed May 5 16:06:54 2021 : Debug: rlm_ldap (ldap): SASL result : cn=Administrator,cn=Users,dc=ad,dc=ourdomain,dc=hu Wed May 5 16:06:54 2021 : Error: rlm_ldap (ldap): Bind with cn=Administrator,cn=Users,dc=ad,dc=ourdomain,dc=hu to ldap://localhost:389 failed: Local error But kinit Administrator works. Thanks, Tamas.