diff --git a/ipaclient/install/client.py b/ipaclient/install/client.py
index 2d3cdf088..0526833dd 100644
--- a/ipaclient/install/client.py
+++ b/ipaclient/install/client.py
@@ -522,8 +522,12 @@ def configure_openldap_conf(fstore, cli_basedn, cli_server):
         {
             'name': 'comment',
             'type': 'comment',
-            'value': '   URI, BASE and TLS_CACERT have been added if they '
-                     'were not set.'
+            'value': '   URI, BASE, TLS_CACERT and SASL_MECH'
+        },
+        {
+            'name': 'comment',
+            'type': 'comment',
+            'value': '   have been added if they were not set.'
         },
         {
             'name': 'comment',
@@ -573,6 +577,12 @@ def configure_openldap_conf(fstore, cli_basedn, cli_server):
             'type': 'option',
             'value': paths.IPA_CA_CRT
         },
+        {
+            'action': 'addifnotset',
+            'name': 'SASL_MECH',
+            'type': 'option',
+            'value': 'GSSAPI'
+        },
     ]
 
     target_fname = paths.OPENLDAP_LDAP_CONF