Configuring a native LDAP domain: example config
by David O'Brien
I'd like to get my example config (below) in sync with latest
recommendations and what the man page has to say. In the process we
might even find some things that need review or update.
1. I've already changed enumerate to false
2. I'm curious about tls_reqcert: I know there are several options
(never, allow, try, etc.), but wonder if in this particular config
demand (hard) is required due to the encrypted channel requirements of
authentication against an LDAP server. Educate me?
3. ldap_tls_cacert value: the man page says the default is use OpenLDAP
defaults, typically in /etc/openldap/ldap.conf. Should I update my
example with the default value?
Again, any suggestions on a better example very welcome.
# A native LDAP domain
[domain/LDAP]
enumerate = false
cache_credentials = TRUE
id_provider = ldap
auth_provider = ldap
ldap_schema = rfc2307
chpass_provider = ldap
ldap_uri = ldap://ldap.mydomain.org
ldap_user_search_base = dc=mydomain,dc=org
tls_reqcert = demand
ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
thanks a lot
--
David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane
"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.
13 years, 10 months
default value for NSS config options
by David O'Brien
In the man page for sssd.conf the default value for
entry_negative_timeout (integer) is given as 15, but doesn't say 15
*what*. Given that enum_cache_timeout (integer) defaults to 120 seconds,
I'm guessing 15 minutes, but I don't like to guess.
thanks
--
David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane
"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.
13 years, 10 months
[PATCH] Use service discovery in backends
by Jakub Hrozek
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Integrate the failover improvements with our back ends. The DNS domain
used in the SRV query is always the SSSD domain name.
Please note that this patch changes the default value of ldap_uri from
"ldap://localhost" to "NULL" in order to use service discovery with no
server set.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkvVVoIACgkQHsardTLnvCWrzgCfRqT54ofqvmV8HIQeGcodxvSe
ttcAn3tq2yY60trBuALwPoIgyjxdbjt0
=aZOZ
-----END PGP SIGNATURE-----
13 years, 10 months