First, I'd recommend upgrading to sasl 2.1.19 or better. Then, check to make sure the ldap server can read the keytab.