I am a newbie myself. Please correct me if I am wrong. GSSAPI mapping is sort of translating the format that Kerberos understands to the format that iPlanet knows. We just had our iPlanet 5.2 worked with Kerberos, meaning a user was able to perform a Kerberos-based authentication to the iPlanet via GSSAPI using ldapsearch.