Hi there, I'm writing to this mailing list looking for some help in order to configure Freeradius on a Kerberos and OpenLDAP GSSAPI-SASL infrastructure. We have everything working flawlessly. Freeradius service and server is working fine with krb5 and ldap modules enabled. The problem is when we need to start the freeradius service. The service only starts if you manually issue a ticket for the service kerberos principal or the host principal. This is such a strange behavior I can't understand. Krb5 module: krb5 { keytab = /etc/radius.keytab service_principal = radius/ex.ample.com pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 lifetime = 0 idle_timeout = 0 } } The keytab /etc/radius.keytab contains the keys for the service principal radius/ex.ample.com. The service should be able to access to the keytab to asks automatically for a ticket for radius/ex.ample.com. But it doesn't. Instead, the service fails until we issue for a new ticket: kinit -k -t /etc/radius.keytab radius/ex.ample.com The ownership of this keytab is radiusd:radiusd and it has reading permissions 440. But I've also tried with 777 with no luck The reason because it does not understand is that ldap has anon bind disallowed and the freeradius service tries an anonymous bind. I know that according to the rules I should have posted the full output debug log but I'm afraid that since it's a totally isolated environment, I can't extract the whole log. Error: rlm_ldap (ldap): Bind with (anonymous) to ldap://ex.ample.com:389 failed: Local error Error: rlm_ldap (ldap): Opening connection failed (0) Error: rlm_ldap (ldap): Error: /etc/raddb/mods-enabled/ldap [8]: Instantiation failed for module "ldap" This is how the ldap module SASL section looks: sasl { mech = 'GSSAPI' realm ='EX.AMPLE.COM' } The most weird behavior is that If we issue a host ticket (kinit -k) it starts and bind correctly using the host/ex.ample.com service principal. No matter that the service principal configured on krb5 module is radius/ex.ample.com Any ideas about how to proceed and the reasons why this happens? We are running the 3.0.15-2.11.2 freeradius version on SuSE12 SP3. Thank you so much. Kind Regards. Dario Garcia Díaz-Miguel GGCS-SES Unit GGCS SKMF Infrastructure Division GMV C\ de Isaac Newton, 11 28760, Tres Cantos, Madrid España +34 918 07 21 00 +34 918 07 21 99 www.gmv.com P Please consider the environment before printing this e-mail.