diff --git a/freeipa.spec.in b/freeipa.spec.in
index fcbad3e97..5a143b643 100644
--- a/freeipa.spec.in
+++ b/freeipa.spec.in
@@ -17,7 +17,7 @@ Source0:        freeipa-%{version}.tar.gz
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 %if ! %{ONLY_CLIENT}
-BuildRequires:  389-ds-base-devel >= 1.3.0
+BuildRequires:  389-ds-base-devel >= 1.3.1.1
 BuildRequires:  svrcore-devel
 BuildRequires:  policycoreutils >= %{POLICYCOREUTILSVER}
 BuildRequires:  systemd-units
@@ -89,7 +89,7 @@ Group: System Environment/Base
 Requires: %{name}-python = %{version}-%{release}
 Requires: %{name}-client = %{version}-%{release}
 Requires: %{name}-admintools = %{version}-%{release}
-Requires: 389-ds-base >= 1.3.0.5
+Requires: 389-ds-base >= 1.3.1.1
 Requires: openldap-clients > 2.4.35-4
 %if 0%{?fedora} == 18
 Requires: nss >= 3.14.3-2
@@ -815,6 +815,10 @@ fi
 %endif  # ! %{ONLY_CLIENT}
 
 %changelog
+* Wed Jun 26 2013 Jan Cholasta <jcholast@redhat.com> - 3.2.99-3
+- Bump minimum version of 389-ds-base to 1.3.1.1 for SASL mapping priority
+  support.
+
 * Mon Jun 17 2013 Petr Viktorin <pviktori@redhat.com> - 3.2.99-2
 - Add the freeipa-tests subpackage
 
diff --git a/install/share/Makefile.am b/install/share/Makefile.am
index 8823723e8..1e56d2c53 100644
--- a/install/share/Makefile.am
+++ b/install/share/Makefile.am
@@ -63,6 +63,7 @@ app_DATA =				\
 	replica-s4u2proxy.ldif		\
 	copy-schema-to-ca.py		\
 	upload-cacert.ldif		\
+	sasl-mapping-fallback.ldif	\
 	$(NULL)
 
 EXTRA_DIST =				\
diff --git a/install/share/sasl-mapping-fallback.ldif b/install/share/sasl-mapping-fallback.ldif
new file mode 100644
index 000000000..ef7f1cc09
--- /dev/null
+++ b/install/share/sasl-mapping-fallback.ldif
@@ -0,0 +1,4 @@
+dn: cn=config
+changetype: modify
+replace: nsslapd-sasl-mapping-fallback
+nsslapd-sasl-mapping-fallback: on
diff --git a/install/updates/10-config.update b/install/updates/10-config.update
index e377689ea..c631b2c23 100644
--- a/install/updates/10-config.update
+++ b/install/updates/10-config.update
@@ -47,3 +47,13 @@ only:nsslapd-minssf-exclude-rootdse:on
 # POSIX winsync plugin
 dn: cn=ipa-winsync,cn=plugins,cn=config
 only: nsslapd-pluginPrecedence: 60
+
+# Enable SASL mapping fallback
+dn: cn=config
+only:nsslapd-sasl-mapping-fallback: on
+
+dn: cn=Full Principal,cn=mapping,cn=sasl,cn=config
+addifnew:nsSaslMapPriority: 10
+
+dn: cn=Name Only,cn=mapping,cn=sasl,cn=config
+addifnew:nsSaslMapPriority: 10
diff --git a/ipaserver/install/dsinstance.py b/ipaserver/install/dsinstance.py
index 01b082a70..e48ced4b8 100644
--- a/ipaserver/install/dsinstance.py
+++ b/ipaserver/install/dsinstance.py
@@ -215,6 +215,7 @@ class DsInstance(service.Service):
         self.step("configure autobind for root", self.__root_autobind)
         self.step("configure new location for managed entries", self.__repoint_managed_entries)
         self.step("configure dirsrv ccache", self.configure_dirsrv_ccache)
+        self.step("enable SASL mapping fallback", self.__enable_sasl_mapping_fallback)
         self.step("restarting directory server", self.__restart_instance)
 
     def __common_post_setup(self):
@@ -657,6 +658,9 @@ class DsInstance(service.Service):
     def __enable_ldapi(self):
         self._ldap_mod("ldapi.ldif", self.sub_dict)
 
+    def __enable_sasl_mapping_fallback(self):
+        self._ldap_mod("sasl-mapping-fallback.ldif", self.sub_dict)
+
     def add_hbac(self):
         self._ldap_mod("default-hbac.ldif", self.sub_dict)
 
diff --git a/ipaserver/install/krbinstance.py b/ipaserver/install/krbinstance.py
index 33cd3489d..a16e4d5f0 100644
--- a/ipaserver/install/krbinstance.py
+++ b/ipaserver/install/krbinstance.py
@@ -277,6 +277,7 @@ class KrbInstance(service.Service):
             nsSaslMapRegexString=['\(.*\)@\(.*\)'],
             nsSaslMapBaseDNTemplate=[self.suffix],
             nsSaslMapFilterTemplate=['(krbPrincipalName=\\1@\\2)'],
+            nsSaslMapPriority=['10'],
         )
         self.admin_conn.add_entry(entry)
 
@@ -288,8 +289,8 @@ class KrbInstance(service.Service):
             cn=["Name Only"],
             nsSaslMapRegexString=['^[^:@]+$'],
             nsSaslMapBaseDNTemplate=[self.suffix],
-            nsSaslMapFilterTemplate=[
-                '(krbPrincipalName=&@%s)' % self.realm],
+            nsSaslMapFilterTemplate=['(krbPrincipalName=&@%s)' % self.realm],
+            nsSaslMapPriority=['10'],
         )
         self.admin_conn.add_entry(entry)