[python-ldap] SASL + REALM

[Sebastian Brause]

Hi,

I've got a problem using python-ldap with SASL + REALM. I don't have any clue what's wrong with it and tumbling around in the dark.
Here is my code snippet:
        ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
        ldap.set_option(ldap.OPT_DEBUG_LEVEL, 4095)
        username = 'ldapadmin-222'
        password = 'pass'
        realm = 'company'
        l = ldap.initialize('ldaps://ldapsrv.mydomain.local:60000', trace_level=2)
        auth_token = ldap.sasl.sasl(
             {
                 ldap.sasl.CB_AUTHNAME:(username),
                 ldap.sasl.CB_PASS:(password),
                 ldap.sasl.CB_USER:(username),
                 ldap.sasl.CB_GETREALM:(realm),
             },
             'DIGEST-MD5'
        )
   try:
        l.sasl_interactive_bind_s( "", auth_token )
   except ldap.LDAPError, e:
        print e
   except ldap.INVALID_CREDENTIALS, e :
        print e
   finally:
        l.unbind_s()

It always fails with
LDAPError - INVALID_CREDENTIALS: {'info': '8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 52e, v1db1', 'desc': 'Invalid credentials'}

That's strange because the OpenLDAP tools work fine (on the same system - so, there are no connection problems, wrong user/password, no certificate issues, etc...)
This works pretty well:
ldapsearch -v -H ldaps://ldapsrv.mydomain.local:60000 -Y DIGEST-MD5 -U "ldapadmin-222" -X "ldapadmin-222" -R "company" "DC=mydomain,DC=local" "cn=*"

So, I don't know what's wrong with my code. I tried it with the current version (python-ldap 2.4.14) and 2.3.10
Thanks for your help in advance. Kind regards,
Seb