HI!
On the LDAP replicas themselves I'd like to use ldapi:// [1] in parameter ldap_uri to use the local slapd as primary server and point to the other replicas in ldap_backup_uri.
Example:
ldap_uri = ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi ldap_backup_uri = ldaps://slapd2.example.com ldaps://slapd3.example.com
But in this case I can see DNS lookups sent to the DNS recursor like this:
Nov 30 00:07:57 dnsrec pdns_recursor[19180]: 2 [674869217] question for '/usr/local/openldap/var/run/ldapi.example.com.|A' from 10.1.32.104
'/usr/local/openldap/var/run/ldapi' is the path name of the LDAPI Unix domain socket and example.com is in the search list in /etc/resolv.conf.
Hmm, I currently don't have access to the machine. Therefore I can't even check whether LDAPI works at all.
=> sssd should avoid DNS lookup completely in case of ldapi:// being used
Any comments before I file a ticket?
Ciao, Michael.
On Fri, Dec 02, 2016 at 03:31:28PM +0100, Michael Ströder wrote:
HI!
On the LDAP replicas themselves I'd like to use ldapi:// [1] in parameter ldap_uri to use the local slapd as primary server and point to the other replicas in ldap_backup_uri.
Example:
ldap_uri = ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi ldap_backup_uri = ldaps://slapd2.example.com ldaps://slapd3.example.com
But in this case I can see DNS lookups sent to the DNS recursor like this:
Nov 30 00:07:57 dnsrec pdns_recursor[19180]: 2 [674869217] question for '/usr/local/openldap/var/run/ldapi.example.com.|A' from 10.1.32.104
'/usr/local/openldap/var/run/ldapi' is the path name of the LDAPI Unix domain socket and example.com is in the search list in /etc/resolv.conf.
Hmm, I currently don't have access to the machine. Therefore I can't even check whether LDAPI works at all.
=> sssd should avoid DNS lookup completely in case of ldapi:// being used
Any comments before I file a ticket?
Ciao, Michael.
ldapi is known to not work: https://fedorahosted.org/sssd/ticket/609
It's been like this forever, but frankly I think you are the first person to request ldapi except developers who find it handy for testing, so I'm not confident we'd implement the support ourvelves. I'm afraid this falls more into the 'patches welcome' territory.
Jakub Hrozek wrote:
ldapi is known to not work: https://fedorahosted.org/sssd/ticket/609
Noted. It's a pity though.
Ciao, Michael.
On (02/12/16 15:31), Michael Ströder wrote:
HI!
On the LDAP replicas themselves I'd like to use ldapi:// [1] in parameter ldap_uri to use the local slapd as primary server and point to the other replicas in ldap_backup_uri.
Example:
ldap_uri = ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi
What about using ldap://localhost?
You woula achieve the goal "to use the local slapd as primary server and point to the other replicas in ldap_backup_uri"
LS
Lukas Slebodnik wrote:
On (02/12/16 15:31), Michael Ströder wrote:
On the LDAP replicas themselves I'd like to use ldapi:// [1] in parameter ldap_uri to use the local slapd as primary server and point to the other replicas in ldap_backup_uri.
Example:
ldap_uri = ldapi://%2Fusr%2Flocal%2Fopenldap%2Fvar%2Frun%2Fldapi
What about using ldap://localhost?
You woula achieve the goal "to use the local slapd as primary server and point to the other replicas in ldap_backup_uri"
Yes, that would be possible too (although I'd prefer to avoid the TCP overhead too).
Is ldap://localhost without StartTLS considered a secure connection? In other words: Does password checking via simple bind work?
Ciao, Michael.
sssd-users@lists.fedorahosted.org