E.7 How Does LDAP Use SASL-GSSAPI?

Once you have configured SASL-GSSAPI, it is added along with the other SASL methods to the supportedSASLMechanisms attribute in rootDSE.

The LDAP server queries SASL for the installed mechanisms when it gets its configuration, and automatically supports whatever is installed. The LDAP server also reports the current supported SASL mechanisms in its rootDSE by using the supportedSASLMechanisms attribute.

Therefore, once you configure GSSAPI, it becomes the default mechanism.

However, to specifically do an LDAP operation over the SASL GSSAPI mechanism, you can mention GSSAPI at the command line.

For example, in OpenLDAP to do a search using the GSSAPI mechanism, enter the following:

ldapsearch -Y GSSAPI -h 164.99.146.48 -b "" -s base