On Wed, Apr 08, 2015 at 03:03:31PM +0200, Pavel Březina wrote:
On 04/07/2015 01:15 PM, Jakub Hrozek wrote:
>Hi,
>
>to reproduce, set up an ldaps:// server (TLS won't reproduce the bug)
>and configure the client as:
>
>[domain/default]
>id_provider = proxy
>proxy_lib_name = files
>auth_provider = ldap
>ldap_uri =
ldaps://openldap.example.com
>ldap_user_search_base = ou=People,dc=example,dc=com
>ldap_group_search_base = ou=People,dc=example,dc=com
>ldap_search_base = dc=example,dc=com
>ldap_tls_reqcert = demand
>ldap_tls_cacertdir = /etc/openldap/cacerts
>ldap_schema = rfc2307bis
>ldap_user_object_class = inetOrgPerson
>debug_level = 9
>timeout = 30000
>
>Before the patch you'll get an error saying you're not connected.
>
>I think the proper solution would be to change the LDAP provider to
>mark the connection as connected automatically, but there is logic in
>sdap_async_connection that should be changed as well and the code around
>whether to use TLS or not is a bit complex. Also, I would prefer to make
>sdap_handle opaque outside the low-level code.
Ack.
Thank you for review, so far pushed to master:
450c2b78ff0bd5044c4c73f32ca8459b211dd446
We'll triage the ticket later.