-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Not all LDAP servers are capable of handling dual-encryption with both TLS and SSL.
Fixes https://fedorahosted.org/sssd/ticket/795
Patches attached for 1.5.x/HEAD and 1.2.x - -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/11/2011 01:24 PM, Stephen Gallagher wrote:
Not all LDAP servers are capable of handling dual-encryption with both TLS and SSL.
Fixes https://fedorahosted.org/sssd/ticket/795
Patches attached for 1.5.x/HEAD and 1.2.x
I made a mistake with the backport to 1.2.x and it was having no effect. Corrected patch attached.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
On Fri, Feb 11, 2011 at 02:36:30PM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/11/2011 01:24 PM, Stephen Gallagher wrote:
Not all LDAP servers are capable of handling dual-encryption with both TLS and SSL.
Fixes https://fedorahosted.org/sssd/ticket/795
Patches attached for 1.5.x/HEAD and 1.2.x
I made a mistake with the backport to 1.2.x and it was having no effect. Corrected patch attached.
The patch is working as expected, but you might want to add a similar check to sdap_cli_resolve_done(). If ldap_id_use_start_tls is set there might be setups where multiple ldap:// and ldaps:// servers are defined, were an explict start TLS is only wnated for the ldap:// services.
bye, Sumit
Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1Vj74ACgkQeiVVYja6o6NYWQCeI5anAWmYxgP/qwKw1exhiqaF KzgAoIBFYf1PN8Ni5qeFHbzNeloKMC/J =hlFZ -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/14/2011 03:31 PM, Sumit Bose wrote:
On Fri, Feb 11, 2011 at 02:36:30PM -0500, Stephen Gallagher wrote: On 02/11/2011 01:24 PM, Stephen Gallagher wrote:
Not all LDAP servers are capable of handling dual-encryption with both TLS and SSL.
Fixes https://fedorahosted.org/sssd/ticket/795
Patches attached for 1.5.x/HEAD and 1.2.x
I made a mistake with the backport to 1.2.x and it was having no effect. Corrected patch attached.
The patch is working as expected, but you might want to add a similar check to sdap_cli_resolve_done(). If ldap_id_use_start_tls is set there might be setups where multiple ldap:// and ldaps:// servers are defined, were an explict start TLS is only wnated for the ldap:// services.
Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
On Mon, Feb 14, 2011 at 04:10:51PM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/14/2011 03:31 PM, Sumit Bose wrote:
On Fri, Feb 11, 2011 at 02:36:30PM -0500, Stephen Gallagher wrote: On 02/11/2011 01:24 PM, Stephen Gallagher wrote:
Not all LDAP servers are capable of handling dual-encryption with both TLS and SSL.
Fixes https://fedorahosted.org/sssd/ticket/795
Patches attached for 1.5.x/HEAD and 1.2.x
I made a mistake with the backport to 1.2.x and it was having no effect. Corrected patch attached.
The patch is working as expected, but you might want to add a similar check to sdap_cli_resolve_done(). If ldap_id_use_start_tls is set there might be setups where multiple ldap:// and ldaps:// servers are defined, were an explict start TLS is only wnated for the ldap:// services.
Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.
Thanks the patch is working as expected, but I have a question about ldapi. It is possilbe to configure a LDAP server to require e.g. TLS even over ldapi, see e.g the discussion in http://www.openldap.org/lists/openldap-technical/200906/msg00098.html. Do we consider this as a configuration error and say use ldaps is ldapi requires TLS or shall we allow TLS over ldapi ?
bye, Sumit
Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1ZmlsACgkQeiVVYja6o6MOfACfahWgHzajAnSbf+bE2aKze2WV r/kAnRETX/cFGnB6hbC4CT+kSPoeGvkr =/mkd -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/15/2011 07:21 AM, Sumit Bose wrote:
On Mon, Feb 14, 2011 at 04:10:51PM -0500, Stephen Gallagher wrote:
Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.
Thanks the patch is working as expected, but I have a question about ldapi. It is possilbe to configure a LDAP server to require e.g. TLS even over ldapi, see e.g the discussion in http://www.openldap.org/lists/openldap-technical/200906/msg00098.html. Do we consider this as a configuration error and say use ldaps is ldapi requires TLS or shall we allow TLS over ldapi ?
With these open questions, I've opted to drop the reference to LDAPI in the ldap_uri_is_secure() function for now until we opt to address https://fedorahosted.org/sssd/ticket/609
New patch attached.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
On Tue, Feb 15, 2011 at 07:43:37AM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/15/2011 07:21 AM, Sumit Bose wrote:
On Mon, Feb 14, 2011 at 04:10:51PM -0500, Stephen Gallagher wrote:
Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.
Thanks the patch is working as expected, but I have a question about ldapi. It is possilbe to configure a LDAP server to require e.g. TLS even over ldapi, see e.g the discussion in http://www.openldap.org/lists/openldap-technical/200906/msg00098.html. Do we consider this as a configuration error and say use ldaps is ldapi requires TLS or shall we allow TLS over ldapi ?
With these open questions, I've opted to drop the reference to LDAPI in the ldap_uri_is_secure() function for now until we opt to address https://fedorahosted.org/sssd/ticket/609
New patch attached.
You have attached only one patch, but I assume you've edited the other one accordingly.
ACK
bye, Sumit
Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1adPkACgkQeiVVYja6o6PnmQCfRgS2zN0CFv1KWofX0NdRQ5gY RqMAnRhmeJ22CHzktbMV5+M5/8iuDs8Z =3Nsd -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/16/2011 07:18 AM, Sumit Bose wrote:
On Tue, Feb 15, 2011 at 07:43:37AM -0500, Stephen Gallagher wrote: On 02/15/2011 07:21 AM, Sumit Bose wrote:
On Mon, Feb 14, 2011 at 04:10:51PM -0500, Stephen Gallagher wrote:
Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.
Thanks the patch is working as expected, but I have a question about ldapi. It is possilbe to configure a LDAP server to require e.g. TLS even over ldapi, see e.g the discussion in http://www.openldap.org/lists/openldap-technical/200906/msg00098.html. Do we consider this as a configuration error and say use ldaps is ldapi requires TLS or shall we allow TLS over ldapi ?
With these open questions, I've opted to drop the reference to LDAPI in the ldap_uri_is_secure() function for now until we opt to address https://fedorahosted.org/sssd/ticket/609
New patch attached.
You have attached only one patch, but I assume you've edited the other one accordingly.
ACK
Whoops. For the record, the patch for 1.2.x is now attached.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
On Wed, Feb 16, 2011 at 07:49:18AM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/16/2011 07:18 AM, Sumit Bose wrote:
On Tue, Feb 15, 2011 at 07:43:37AM -0500, Stephen Gallagher wrote: On 02/15/2011 07:21 AM, Sumit Bose wrote:
On Mon, Feb 14, 2011 at 04:10:51PM -0500, Stephen Gallagher wrote:
Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.
Thanks the patch is working as expected, but I have a question about ldapi. It is possilbe to configure a LDAP server to require e.g. TLS even over ldapi, see e.g the discussion in http://www.openldap.org/lists/openldap-technical/200906/msg00098.html. Do we consider this as a configuration error and say use ldaps is ldapi requires TLS or shall we allow TLS over ldapi ?
With these open questions, I've opted to drop the reference to LDAPI in the ldap_uri_is_secure() function for now until we opt to address https://fedorahosted.org/sssd/ticket/609
New patch attached.
You have attached only one patch, but I assume you've edited the other one accordingly.
ACK
Whoops. For the record, the patch for 1.2.x is now attached.
ACK to this one as well.
bye, Sumit
Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk1bx84ACgkQeiVVYja6o6N3ugCgg1P1QMhJKBG2dNPJrgF1fv6T H10Anisixl/eQMk3jpQ0oi8VbfvaE4nF =ycXV -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/16/2011 08:39 AM, Sumit Bose wrote:
On Wed, Feb 16, 2011 at 07:49:18AM -0500, Stephen Gallagher wrote:
Whoops. For the record, the patch for 1.2.x is now attached.
ACK to this one as well.
Pushed to sssd-1-2
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 02/16/2011 07:18 AM, Sumit Bose wrote:
On Tue, Feb 15, 2011 at 07:43:37AM -0500, Stephen Gallagher wrote: On 02/15/2011 07:21 AM, Sumit Bose wrote:
On Mon, Feb 14, 2011 at 04:10:51PM -0500, Stephen Gallagher wrote:
Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.
Thanks the patch is working as expected, but I have a question about ldapi. It is possilbe to configure a LDAP server to require e.g. TLS even over ldapi, see e.g the discussion in http://www.openldap.org/lists/openldap-technical/200906/msg00098.html. Do we consider this as a configuration error and say use ldaps is ldapi requires TLS or shall we allow TLS over ldapi ?
With these open questions, I've opted to drop the reference to LDAPI in the ldap_uri_is_secure() function for now until we opt to address https://fedorahosted.org/sssd/ticket/609
New patch attached.
You have attached only one patch, but I assume you've edited the other one accordingly.
ACK
Pushed to master and sssd-1-5.
- -- Stephen Gallagher RHCE 804006346421761
Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/
sssd-devel@lists.fedorahosted.org
-
Stephen Gallagher -
Sumit Bose