Hi,
to reproduce, set up an ldaps:// server (TLS won't reproduce the bug)
and configure the client as:
[domain/default]
id_provider = proxy
proxy_lib_name = files
auth_provider = ldap
ldap_uri =
ldaps://openldap.example.com
ldap_user_search_base = ou=People,dc=example,dc=com
ldap_group_search_base = ou=People,dc=example,dc=com
ldap_search_base = dc=example,dc=com
ldap_tls_reqcert = demand
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_schema = rfc2307bis
ldap_user_object_class = inetOrgPerson
debug_level = 9
timeout = 30000
Before the patch you'll get an error saying you're not connected.
I think the proper solution would be to change the LDAP provider to
mark the connection as connected automatically, but there is logic in
sdap_async_connection that should be changed as well and the code around
whether to use TLS or not is a bit complex. Also, I would prefer to make
sdap_handle opaque outside the low-level code.