URL:
https://github.com/SSSD/sssd/pull/700
Title: #700: LDAP: Only authenticate the auth connection if we need to look up user
information
jhrozek commented:
"""
Thank you, this is nice. I added your patch to the PR, fixed one typo and one minor style
issue. If you're OK with the fixes, I will squash the last patch into yours and push
them all once CI finishes.
If we want to do additional hardening, we can even save the value of the
SDAP_DISABLE_AUTH_TLS variable and unless it is set to TRUE, we can even abort the
authentication if no encryption is selected.
btw during testing, I even listened to the traffic with tcpdump and then checked the pcap
files to make sure the traffic is encrypted, so at least for the cases that were tested I
know we are fine. But the patch is very nice to have for sure.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/700#issuecomment-441581678