On to, 22 elo 2019, Jonathan Vaughn wrote:
Well, the specific products we need to talk to FreeIPA support LDAPS (implicit SSL via port 636, rather than explicit via STARTTLS on port 389 - in fact at least some only support implicit), 389DS does support LDAPS (even if it is not a FreeIPA sanctioned mode), so as the saying goes if it's stupid and it works, it ain't stupid. :)
For server sign-on and so forth, SSSD and so on will do what they do normally - we aren't mangling any of the pre-defined DNS or other FreeIPA magic. This is just to provide a highly available and secure LDAP service for everything else that can't use the multiple SRV records or other means of assigning / detecting multiple LDAP servers (i.e. Jira, Confluence, Bitbucket ... )
Yes, that was clear -- I was more worried on not going that backwards with LDAPS replacement of what is relying on LDAP STARTTLS + GSSAPI.
On Thu, Aug 22, 2019 at 1:22 AM Alexander Bokovoy abokovoy@redhat.com wrote:
On ke, 21 elo 2019, Jonathan Vaughn via FreeIPA-users wrote:
Ah, I didn't realize I could do SSL termination in TCP mode. That would certainly solve our LDAP HA problem with less effort! I'll try that.
Note that FreeIPA doesn't really use LDAPS (and there is no such thing as LDAPS in protocol specs, it was never formalized). FreeIPA uses startTLS in LDAP -- at least SSSD will actively rely on it. Also Windows doesn't allow use of LDAPS+GSSAPI.
On Wed, Aug 21, 2019 at 8:27 PM Daniel Oetken via FreeIPA-users < freeipa-users@lists.fedorahosted.org> wrote:
Why doesn’t terminating SSL on the proxy work with LDAPS? Because it should, and says so too here: https://www.mail-archive.com/haproxy@formilux.org/msg21657.html
Though, I’m looking into the same thing to add SAN to the server certificate and wondering about similar questions. When you look at “ipa-getcert list” you should see the current certificates already, including their settings, so I was thinking to just stop tracking those
old
ones and create new ones like you did, except with the exact same
options
as the old ones (+ SAN). But yeah, I’m not sure if there is anything
else
involved, or if there is a better way. I only started using freeipa recently. _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to
freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...
-- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland