URL:
https://github.com/SSSD/sssd/pull/700
Title: #700: LDAP: Only authenticate the auth connection if we need to look up user
information
jhrozek commented:
"""
I chose this approach because it only touches the ldap auth code. The other approach I was
considering was to not force off the authentication, but turn the skip_auth boolean into a
tri-state (do_auth, skip_auth, auth_if_possible). Then the caller from the ldap auth code
would select auth_if_possible if the DN is known and do_auth if the DN must be looked
up.
What auth_if_possible would do is to check if GSSAPI is the authentication method and only
skip only the GSSAPI auth step. This would make it possible to use other authentication
methods, whatever they might be in case the DN must be looked up.
And even another approach might be to establish authenticated connection to look up the
user, then close is and authenticate the user using a second connection.
But currently the only use-case that doesn't work with the current approach is
id_provider=proxy and auth_provider=ldap where the LDAP server is AD DC. In this case, you
must look up the user, so the connection must be authenticated, but using TLS and GSSAPI
together wouldn't work. And I'm not sure if this use-case is important enough to
consider either two connections or touching the connection code.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/700#issuecomment-441025645