Hi,
currently we have two competing features in the LDAP provider. One the
one hand we want to avoid further DNS lookups by the OpenLDAP client
libraries and want to talk to the same LDAP server as long as possible.
To achieve this we create LDAP URIs with the IP instead of the server
name and pass them to ldap_initialize(). But this in general leads to
failures when TLS/SSL certificates are validated, because here the node
part of the URI is extracted and compared to the common name and the
subject alternative names in the certificate. If the IP address of the
server is not among them, which in general is the case, the validation
fails.
To solve this this series of patches substitutes ldap_initialize() by a
sequence of socket(), connect() and ldap_init_fd(). Now we can use the
IP address during connect() and the URI iwth the server name in
ldap_init_fd().
The corresponding trac ticket is
https://fedorahosted.org/sssd/ticket/905 .
bye,
Sumit