Hey Stephen, Just a little more information incase this helps in troubleshooting. After talking to my group i was reminded that the reason we cant use TLS is because we are using hardware loadbalancers to handle the ssl offload and proxy between multiple ldap servers.

Is there any reason you can think of that using a loadbalancer in this case would cause an initial ldaps connection to fail?

I noticed in the logs that even though i explicitly request sssd to not use start_tls, it still runs:

"Executing START_TLS"

is there any way to stop this behavior?

On Thu, Feb 10, 2011 at 3:41 PM, sssd help <sssdhelp@gmail.com> wrote:
I can also confirm that i am using a CA cert bundle provided by our CA.


On Thu, Feb 10, 2011 at 3:28 PM, Stephen Gallagher <sgallagh@redhat.com> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/10/2011 03:25 PM, sssd help wrote:
> We are using Sun DSEE 6. Would errors regarding certificate failures be in
> the same /var/log/sssd/sssd_default.log or one of the others.
>

It should still be in /var/log/sssd/sssd_default.log

I'm at something of a loss on the ldap_result issue though. I don't have
a clue why it would behave any differently on LDAPS as opposed to LDAP+TLS.

- --
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1USlIACgkQeiVVYja6o6P7iACfQtLFQjYCxp7hgSbStc3VAlTy
kp8Aniyog28zrjhFxul6WFKeEFs0KsaT
=XXMe
-----END PGP SIGNATURE-----
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel