On Mon, Feb 14, 2011 at 04:10:51PM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/14/2011 03:31 PM, Sumit Bose wrote:
> On Fri, Feb 11, 2011 at 02:36:30PM -0500, Stephen Gallagher wrote:
> On 02/11/2011 01:24 PM, Stephen Gallagher wrote:
>>>> Not all LDAP servers are capable of handling dual-encryption with
>>>> both TLS and SSL.
>>>>
>>>> Fixes
https://fedorahosted.org/sssd/ticket/795
>>>>
>>>> Patches attached for 1.5.x/HEAD and 1.2.x
>
> I made a mistake with the backport to 1.2.x and it was having no effect.
> Corrected patch attached.
>
>
>> The patch is working as expected, but you might want to add a similar
>> check to sdap_cli_resolve_done(). If ldap_id_use_start_tls is set there
>> might be setups where multiple ldap:// and ldaps:// servers are defined,
>> were an explict start TLS is only wnated for the ldap:// services.
>
Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.
Thanks the patch is working as expected, but I have a question about
ldapi. It is possilbe to configure a LDAP server to require e.g. TLS
even over ldapi, see e.g the discussion in
http://www.openldap.org/lists/openldap-technical/200906/msg00098.html.
Do we consider this as a configuration error and say use ldaps is ldapi
requires TLS or shall we allow TLS over ldapi ?
bye,
Sumit
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora -
http://enigmail.mozdev.org/
iEYEARECAAYFAk1ZmlsACgkQeiVVYja6o6MOfACfahWgHzajAnSbf+bE2aKze2WV
r/kAnRETX/cFGnB6hbC4CT+kSPoeGvkr
=/mkd
-----END PGP SIGNATURE-----