URL:
https://github.com/SSSD/sssd/pull/700
Author: jhrozek
Title: #700: LDAP: Only authenticate the auth connection if we need to look up user
information
Action: opened
PR body:
"""
Related:
https://pagure.io/SSSD/sssd/issue/3451
Commit add72860c7a7a2c418f4d8b6790b5caeaf7dfb7b initially addressed #3451
by using the full sdap_cli_connect() request during LDAP authentication.
This was a good idea as it addressed the case where the authentication
connection must also look up some user information (typically with
id_provider=proxy where you don't know the DN to bind as during
authentication), but this approach also broke the use-case of
id_provider=ldap and auth_provider=ldap with ldap_sasl_auth=gssapi.
This is because (for reason I don't know) AD doesn't like if you use both
GSSAPI and startTLS on the same connection. But the code would force TLS
during the authentication as a general measure to not transmit passwords in
the clear, but then, the connection would also see that
ldap_sasl_auth=gssapi is set and also bind with GSSAPI.
This patch checks if the user DN is already known and if yes, then doesn't
authenticate the connection as the connection will then only be used for
the user simple bind.
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/700/head:pr700
git checkout pr700