Exporting The Trusted Root Certificate; Configuring The Sasl-Gssapi Method - Novell EDIRECTORY 8.8 - ADMINISTRATION Manual

NOTE: If you do not specify the -h option, the name of the local host that krbldapconfig is invoked
from is used as the default.
If you do not specify the LDAP server port and the trusted root certificate, the default port 389 is
used.
If you do not specify the LDAP server port but specify the trusted root certificate, the default port
636 is used.
For example, enter the following to add the extensions:
krbldapconfig -i -D cn=admin,o=org -w password -h ldapserver -p 389
Or to remove, enter the following:
krbldapconfig -u -D cn=admin,o=org -w password -h ldapserver -p 389
IMPORTANT: You must manually refresh the LDAP server for the installation changes to take
effect. For more information, refer to
E.1.4 Exporting the Trusted Root Certificate
1 In iManager, click eDirectory Administration > Modify Object to open the Modify Object page.
2 Click Single Object, then select the Server Certificate object of the server.
3 Click OK.
4 Click the Certificates tab, then select Trusted Root Certificate and view the details of the
certificate.
5 Click Export to launch the Certificate Export Wizard.
6 Specify whether you want to export the private key or not, then click Next.
7 Select File in Binary DER Format, then click Next.
8 Click Save the Exported Certificate to a File.
9 Click Close.
E.2 Configuring the SASL-GSSAPI Method
1 The iManager plug-in for SASL-GSSAPI will not work if iManager is not configured to use
SSL/TLS connection to eDirectory. A secure connection is mandated to protect the realm's
master key and principal keys.
By default, iManager is usually configured for SSL/TLS connection to eDirectory. You need to
add the SSL trusted root certificates of the LDAP server that you use for Kerberos
administration to iManager.
For information on configuring iManager with SSL/TLS connection to eDirectory, refer to the
iManager 2.0 Administration Guide (http://www.novell.com/documentation/lg/imanager20/
index.html?page=/documentation/lg/imanager20/imanager20/data/am4ajce.html#bow4dv4).
2 Complete the following procedures in the order given:
2a
Extend the Kerberos
Section 13.5, "Refreshing the LDAP Server," on page
Schema.
344.
Configuring GSSAPI with eDirectory 567