<html><head></head><body>That's right.<br>GSS-API is not used anywhere else.<br>Do you like to inspect my full configuration?<br>I can dump connection session and send pcap file here.<br><br><div class="gmail_quote">On August 15, 2019 7:27:20 AM GMT+03:00, Aki Tuomi <aki.tuomi@open-xchange.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail"><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">On 15/08/2019 00:34 Eugene via dovecot <dovecot@dovecot.org> wrote:<br><br> <br>The next combination of parameters makes 100% LDAP connections unsuccessful (the log snippet form the previous mail).<br>sasl_bind = yes<br>sasl_mech = gssapi<br>tls = yes<br><br>Looks like this combination is utterly incorrect and should be prohibited (tls must not be used when mech is gssapi).<br><a href="https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org/message/G7S2TOFDCM62ZUHIBWYVZIEVYXO3KYAI/">https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org/message/G7S2TOFDCM62ZUHIBWYVZIEVYXO3KYAI/</a><br><br>With `tls = no` errors `encoded packet size too big` becomes sporadic, but still heart auth orepations performance.<br>May be there are two different problems.<br><br></blockquote><br>Does the "encoded packet size too big" coincide with LDAP server connection failure?<br><br>Aki<br><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;">Has someone encountered this problem before?<br>How can I help to facilitate the issue debugging?<br><br>[I] net-mail/dovecot<br> Installed versions: 2.3.7.1(01:58:12 08/14/19)(bzip2 caps ipv6 kerberos ldap libressl lua lz4 lzma pam postgres sieve sqlite tcpd zlib -argon2 -doc -lucene -managesieve -mysql -selinux -solr -static-libs -suid -textcat -vpopmail)<br><br>On 8/15/19 12:01 AM, Eugene wrote:<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;">Hello!<br><br>Dovecot uses it's own SASL implementation, doesn't it?<br><br> Aug 14 23:45:23 example.com auth[10428]: GSSAPI client step 1<br> Aug 14 23:45:23 example.com auth[10428]: encoded packet size too big (813804546 > 65536)<br> Aug 14 23:45:23 example.com dovecot[10085]: auth-worker(10428): Error: LDAP: Can't connect to server: ldap://ipa2.example.com<br> Aug 14 23:45:23 example.com dovecot[10085]: auth: Error: auth worker: Aborted USER request for eugene: Lookup timed out<br> Aug 14 23:45:23 example.com dovecot[10085]: imap: Error: auth-master: login: request [3847225345]: Login auth request failed: Internal auth failure (auth connected 60000 msecs ago, request took 60000 msecs, client-pid=10362 client-id=1)<br><br>Looks like cyrus-sasl encountered same problem earlier.<br><a href="https://lists.andrew.cmu.edu/pipermail/cyrus-sasl/2017-March/003001.html">https://lists.andrew.cmu.edu/pipermail/cyrus-sasl/2017-March/003001.html</a><br><br>I never have such an issue with ldapsearch. So, I assume there is a similar problem in Dovecot SASL implementation.<br><br></blockquote><br>-- <br>Eugene Bright<br>IT engineer<br>Tel: + 79257289622<br></blockquote></pre></blockquote></div><hr>Eugene Bright<br>IT-engineer<br>Tel.: +7 925 728 96 22<br></body></html>