-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 05/28/2010 04:35 AM, David O'Brien wrote:
I'd like to get my example config (below) in sync with latest
recommendations and what the man page has to say. In the process we
might even find some things that need review or update.
1. I've already changed enumerate to false
Sorry to nitpick, but maybe we should be consistent about using TRUE vs.
true and false vs. FALSE in the examples.
2. I'm curious about tls_reqcert: I know there are several
options
(never, allow, try, etc.), but wonder if in this particular config
demand (hard) is required due to the encrypted channel requirements of
authentication against an LDAP server. Educate me?
Setting tls_reqcert to hard is not required for authentication. We only
require that the ldap authentication must be done over a secure channel.
When setting up this encrypted channel, the server may be asked to
present itself with its certificate, the client can then checks the
certificate to verify the authenticity of the server. The
ldap_tls_reqcert option specifies whether to request the server
certificate and what checks to perform.
3. ldap_tls_cacert value: the man page says the default is use
OpenLDAP
defaults, typically in /etc/openldap/ldap.conf. Should I update my
example with the default value?
I personally don't have a strong preference.. The current example points
to Mozilla CA cert bundle which might be OK for deployments that have
commercial certificates from companies like VeriSign. Not sure how
representative this example is in real world..but I suspect many
deployments will just use their own internal CA or even self-signed
certificates.
Again, any suggestions on a better example very welcome.
I wonder if the example config should list "ldap_search_base" instead of
"ldap_user_search_base". If we are going to include
ldap_user_search_base, I think we should also include
ldap_group_search_base.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAkv/t2oACgkQHsardTLnvCWAMQCbBNsnSyVdm54KP4WwYslyjmY/
JpEAn12bKLw6b1729JNY++J9uLyCtK8h
=9oyo
-----END PGP SIGNATURE-----