References: <CAFk47JiYykCQ11RapDWrbUy_AhGWNnhz9AoE=e+CCzMiDoRZZQ@mail.gmail.com>
 <RT-Ticket-9182@mit.edu>
In-Reply-To: <CAFk47JiYykCQ11RapDWrbUy_AhGWNnhz9AoE=e+CCzMiDoRZZQ@mail.gmail.com>
X-RT-Original-Encoding: utf-8
Content-Type: text/html; charset="utf-8"
X-Mailer: MIME-tools 5.509 (Entity 5.509)
Message-ID: <rt-4.4.3-2-726432-1756271744-1626.9182-0-0@mit.edu>
MIME-Version: 1.0
Content-Transfer-Encoding: binary
Content-Disposition: inline
X-RT-Interface: Web
RT-Send-CC:
Content-Length: 723

The service stash file should contain:
<pre>
cn=kdc-srv,cn=krbContainer,dc=example,dc=local#{HEX}...
cn=adm-srv,cn=krbContainer,dc=example,dc=local#{HEX}...</pre>
where the &quot;...&quot;s are the hex encoding of the supplied passwords.&nbsp; In what way is the file malformed?&nbsp; libkdb5_util is able to read a password from it, or you would see an error about reading the stash file instead of an error about the LDAP server rejecting the credentials.&nbsp; If I run the given commands, the resulting file does not seem amiss.<br />
<br />
(As an aside, the -D and -w options to these kdb5_ldap_util invocations should be unnecessary, as this subcommand does not need to authenticate to the LDAP server.)<br />
&nbsp;