Hi John,
first of all thanks for your answer.
I'm not and AD/LDAP/SSSD expert, sorry in advance for my ignorance.
this is what I understand:
those changes might require to use LDAP with TLS either with START_TLS
on the LDAP port or using LDAPS.
I understand that we have to enforce TLS or LDAPS (which bring to my original email, how?).
Additionally SSSD uses SASL/GSSAPI/GSS-SPNEGO for encryption with cannot
I still don't understand why ldaps is not required for encrypted comms.
Could you please elaborate a little your answer?
If we stick to ldap provider , who should we configure sssd if we cannot join the server to the domain?
also, I realize that we are running a very old sssd version (1.14) so any new feature from version 2 is not available.
TIA,
Arnau