diff --git a/ldap.conf b/ldap.conf
index 01c3429..661a259 100644
--- a/ldap.conf
+++ b/ldap.conf
@@ -13,3 +13,6 @@
 #DEREF		never
 
 TLS_CACERTDIR	/etc/openldap/certs
+
+# Turning this off breaks GSSAPI used with krb5 when rdns = false
+SASL_NOCANON	on
\ No newline at end of file
diff --git a/openldap.spec b/openldap.spec
index fd45054..0506c3d 100644
--- a/openldap.spec
+++ b/openldap.spec
@@ -599,6 +599,7 @@ exit 0
 %changelog
 * Tue Apr 09 2013 Jan Synáček <jsynacek@redhat.com> 2.4.35-3
 - fix: minor documentation fixes
+- set SASL_NOCANON to on by default (#949864)
 
 * Fri Apr 05 2013 Jan Synáček <jsynacek@redhat.com> 2.4.35-2
 - drop the evolution patch