I'm running a Samba 4 domain controller (version 4.9.4-Debian).

• Operating system: Debian Buster
• Python version: Python 3.7.3rc1
• python-ldap version: 3.2.0

I can successfully use ldapsearch with GSSAPI SASL authentication to search for users:

$ kinit someone
...

ldapsearch -Y GSSAPI -H "ldap://samba-dc.ad.example.com" -b "dc=ad,dc=example,dc=com" "(objectClass=user)" sAMAccountName

However, when I attempt to use this Python snippet:

import ldap,ldap.sasl
from pprint import pprint

l = ldap.initialize("ldap://samba-dc.ad.example.com", trace_level=100)

rc = l.sasl_gssapi_bind_s()

base = "dc=ad,dc=example,dc=com"
criteria = "(objectClass=user)"
result = l.search_s(base, ldap.SCOPE_SUBTREE, criteria)
pprint(result)

It doesn't work, and I get this error:

ldap.OPERATIONS_ERROR: {'desc': 'Operations error', 'info': '00002020: Operation unavailable without authentication'}

FWIW: I can't get this to work with ldap3 either: cannatag/ldap3#669 That issue is unrelated.