On Mon, Feb 14, 2011 at 04:10:51PM -0500, Stephen Gallagher wrote:
-----BEGIN PGP SIGNED MESSAGE-----
On 02/14/2011 03:31 PM, Sumit Bose wrote:
> On Fri, Feb 11, 2011 at 02:36:30PM -0500, Stephen Gallagher wrote:
> On 02/11/2011 01:24 PM, Stephen Gallagher wrote:
>>>> Not all LDAP servers are capable of handling dual-encryption with
>>>> both TLS and SSL.
>>>> Fixes https://fedorahosted.org/sssd/ticket/795
>>>> Patches attached for 1.5.x/HEAD and 1.2.x
> I made a mistake with the backport to 1.2.x and it was having no effect.
> Corrected patch attached.
>> The patch is working as expected, but you might want to add a similar
>> check to sdap_cli_resolve_done(). If ldap_id_use_start_tls is set there
>> might be setups where multiple ldap:// and ldaps:// servers are defined,
>> were an explict start TLS is only wnated for the ldap:// services.
Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.
Thanks the patch is working as expected, but I have a question about
ldapi. It is possilbe to configure a LDAP server to require e.g. TLS
even over ldapi, see e.g the discussion in
Do we consider this as a configuration error and say use ldaps is ldapi
requires TLS or shall we allow TLS over ldapi ?
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----