On Fri, 10 May 2013, Joshua Riffle wrote:
As pointed out to me in a couple of the other responses TLS and not
SSL is
probably the better way to go which is surprising to me but admittedly I am
new to the LDAP security world and that will give me something to research
more deeply. Does SSSD cater more to the TLS + LDAP combination?
I think this is just a general truism. You end up with a single service on a
single port that allows connections at an appropriate security level as
defined in rules server side. TLS is the successor to SSL.
My hope was to see how far I could get with a fairly secure Kerberos
+ LDAP
combination that could (mostly) automatically be pushed to the clients
(SSSD) with as little configuration as possible. Initially LDAPS seemed to
make sense and SRV records for DNS Discovery also seemed like a decent
choice.
I think you're basically spot on, apart from your choice of SSL over TLS.
Service Discovery is *clearly* the way to go IMO.
Feel free to ask about anything else, minimal configuration LDAP(TLS) + krb5
is the setup I use, albeit against Active Directory.
jh