URL:
https://github.com/SSSD/sssd/pull/700
Title: #700: LDAP: Only authenticate the auth connection if we need to look up user
information
sumit-bose commented:
"""
Thanks, yes, I'm fine with the changes. However, I just came across ldap_tls_inplace()
which we already use and I guess it more portable. Here is my new version:
```
diff --git a/src/providers/ldap/ldap_auth.c b/src/providers/ldap/ldap_auth.c
index b4d045a..4666dbf 100644
--- a/src/providers/ldap/ldap_auth.c
+++ b/src/providers/ldap/ldap_auth.c
@@ -747,6 +747,31 @@ static struct tevent_req *auth_connect_send(struct tevent_req *req)
return subreq;
}
+static void check_encryption(LDAP *ldap)
+{
+ ber_len_t sasl_ssf = 0;
+ int tls_inplace = 0;
+ int ret;
+
+ ret = ldap_get_option(ldap, LDAP_OPT_X_SASL_SSF, &sasl_ssf);
+ if (ret != LDAP_SUCCESS) {
+ DEBUG(SSSDBG_TRACE_LIBS, "ldap_get_option failed to get sasl ssf, "
+ "assuming SASL is not used.\n");
+ }
+
+ tls_inplace = ldap_tls_inplace(ldap);
+
+ DEBUG(SSSDBG_TRACE_ALL,
+ "Encryption used: SASL SSF [%lu] tls_inplace [%s].\n", sasl_ssf,
+ tls_inplace == 1 ? "TLS inplace" : "TLS NOT inplace");
+
+ if (sasl_ssf <= 1 && tls_inplace != 1) {
+ DEBUG(SSSDBG_CRIT_FAILURE,
+ "No encryption detected on LDAP connection.\n");
+ sss_log(SSS_LOG_CRIT, "No encryption detected on LDAP
connection.\n");
+ }
+}
+
static void auth_connect_done(struct tevent_req *subreq)
{
struct tevent_req *req = tevent_req_callback_data(subreq,
@@ -776,6 +801,8 @@ static void auth_connect_done(struct tevent_req *subreq)
return;
}
+ check_encryption(state->sh->ldap);
+
if (state->dn == NULL) {
/* The cached user entry was missing the bind DN. Need to look
* it up based on user name in order to perform the bind */
```
"""
See the full comment at
https://github.com/SSSD/sssd/pull/700#issuecomment-441596122