This is great. Thank you for providing the new rpms.

However, I installed them and it looks like START_TLS isnt quite out of the picture.

[root@mgnttest02 sssd]# rpm -qa sssd
sssd-1.2.1-28.el6.4.2.x86_64

from the sssd_default.log

(Fri Feb 11 14:27:08 2011) [sssd[be[default]]] [auth_resolve_done] (8): [ldaps://ldap.mydomain.com/] is a secure channel. No need to run START_TLS
(Fri Feb 11 14:27:08 2011) [sssd[be[default]]] [sdap_connect_send] (4): Executing START TLS

Looks like sssd is still trying to start tls.

On Fri, Feb 11, 2011 at 1:52 PM, Stephen Gallagher <sgallagh@redhat.com> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/11/2011 12:23 PM, sssd help wrote:
> Thank you for the taking a look Sumit.
>
> I am testing with ldapsearch now. My first searches are returning:
> ldap_start_tls: Connect error (-11)
>
> which i guess is what we would expect since we cant do tls against our load
> balancers. I will continue testing and let you know if I come up with
> something different.
>

Ok, this is actually probably a bug in the SSSD then. We shouldn't be
attempting to perform a START_TLS while using LDAPS.

Sumit opened https://fedorahosted.org/sssd/ticket/795 to track fixing this.

I've submitted a patch for this issue to the list and kicked off a
scratch-build for RHEL 6 RPMs. Please try
http://koji.fedoraproject.org/koji/taskinfo?taskID=2833544 and let me
know if it resolves your issue.

- --
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1VhYYACgkQeiVVYja6o6OyngCZATEZjYYhbz2V+AWlPmBT9nbu
68QAn2CMQMx9ZtQj/UcesV33vRf+aQJP
=IhEN
-----END PGP SIGNATURE-----
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel