I’ve been moving from an internal ldap module to one in Puppet Labs. Through this process I’ve forgotten about sasl. Installing the openldap-client package on the system and upgrading heimdal to the latest version caused the packages to come from upstream repositories that do not have the custom options necessary to glue together heimdal and openldap.