We should add separate option for kerberos principal in keytab.

For some reason OpenLDAP refuse login if I use sasl_user. OpenLDAP try to do proxy login which always fail. openldap-client send empty sasl_user for GSSAPI login. To send empty sasl_user we need separate option for krb5 principal so we could init keytab.

Here is sample config:
dynamic-db "ldapdns" {
library "ldap.so";
arg "connections 2";
arg "uri ldap://myhost";
arg "base ou=DNS,dc=mybase";
arg "cache_ttl 300";
arg "auth_method sasl";
arg "krb5_keytab FILE:/etc/named/named.keytab";
arg "krb5_principal dns/myhost";
arg "sasl_mech GSSAPI";
}