list principals using ldap back end

[Tom Parker]

  Hi Kevin,

One more thing I just thought of.

Check the value for sscope (Search Scope).  It should be in your 
Kerberos Realm Container as krbSearchScope.  If this is set to 1 it will 
not search your subtrees.

 From the krb5_ldap_util man page:

-sscope search_scope
          Specifies the scope for searching the principals under the 
subtrees.  The possible values are 1 or one (one level), 2 or sub 
(subtrees).

You can fix this with the krb5_ldap_util modify command or by 
adding/modifying this attribute in your krbRealmContainer

Tom

On 09/30/2010 03:10 PM, Kevin Longfellow wrote:
> Hi,
>
> I tried to find this in the documentation so if someone could point me in the
> right direction, I would appreciate it.  I am trying to list all the kerberos
> principals created with a LDAP back end that are not in the realm container.
> Using kadmin list_principals only shows what is in the realm container.  We have
> the user principals in a different cn by using -subtrees when the realm was
> created.  It looks like kdb5_ldap_util might be able to do this?
>
> Thanks for any help with this.
>
> Kevin
>
>
>
>
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos