On Fri, Feb 11, 2011 at 07:27:36AM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/10/2011 06:08 PM, sssd help wrote:
> Hey Stephen, Just a little more information incase this helps in
> troubleshooting. After talking to my group i was reminded that the reason we
> cant use TLS is because we are using hardware loadbalancers to handle the
> ssl offload and proxy between multiple ldap servers.
>
> Is there any reason you can think of that using a loadbalancer in this case
> would cause an initial ldaps connection to fail?
It's possible that a faulty SSL load balancer might be resulting in
sending back invalid data. But I'd assume you'd be seeing that in all
your clients, not just SSSD. It's worth investigating, though. It's
possible that the load balancers are adding something to the message
that SSSD is not expecting (but should be). It's hard to debug over SSL,
though.
> I noticed in the logs that even though i explicitly request sssd to not use
> start_tls, it still runs:
>
> "Executing START_TLS"
>
> is there any way to stop this behavior?
Are you seeing that START_TLS message when you have an ldaps:// URI
specified? That sounds like a bug, if so. (Shouldn't be happening; we
check for whether an encrypted channel is already available before we
call that function)
I've just checked, we call START_TLS on every authentication and do not
check if TLS is already active due to ldaps. Maybe Sun DSEE does not
like the double encryption. Can you check if
ldapsearch -ZZ -H ldaps://....
works with your LDAP server?
bye,
Sumit