Hi Lukas,
thanks for the explanation.

After some more testing I found that sssd version 1.16 works with SSL even if the version of openldap are not compiled with SSL support. SSSD suddenly requires  ldap_tls_cacert to find the CA, even when you use SSL (ldaps in the uri). Does it make any sense? 

We can upgrade sssd in SL7, only few RH6/SL6 will special upgrade processes...


On Fri, 27 Mar 2020 at 16:32, Lukas Slebodnik <lslebodn@redhat.com> wrote:
On (27/03/20 16:12), Arnau Bria wrote:
>Hi all,
>something I've found is that the openldap behaivour I've described really
>depend on the openldap version. With versions older that 2.4.44-15 (in SL)
>openldap only knows about Mozilla DB whereas in newer version it fallsback
>to OpenSSL and openldap then reads the certificates from the PKI store.
>IOW, with newer openldap there's no need to create the Mozilla DB.

Yes, it depends which crypto was used in openldap.

centos7 and old version of fedora was compiled with NSS
later version moved to openssl but some distribution has some compatibility
with NSS (convert NSS on the fly to format which works with openssl)
Tha compatibility was remove in fedora29 and thus newer version
support just openssl.

sssd-users mailing list -- sssd-users@lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/sssd-users@lists.fedorahosted.org

Arnau Bria