[SSSD] [PATCH] Check if SSL/TLS handler is already in place

Sumit Bose sbose at redhat.com
Wed Sep 16 11:21:57 UTC 2009


Hi,

authentication via LDAPS currently fails, see bug #183. This patch
should fix it.

bye,
Sumit
-------------- next part --------------
>From fe00b098f55e12e3ebb3e3a2f51a32e8b3919d67 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 16 Sep 2009 13:02:47 +0200
Subject: [PATCH] Check if SSL/TLS handler is already in place

Authentication against a LDAP server should always use an
encrypted connection. To acchive this the LDAP provider calls
ldap_start_tls which will fail if the connection is already
encrypted, e.g. if an ldaps tunnel is already established.
Because the error message from ldap_start_tls is not specific we
check the status with ldap_tls_inplace before calling ldap_start_tls.
---
 server/providers/ldap/sdap_async.c |    9 ++++++++-
 1 files changed, 8 insertions(+), 1 deletions(-)

diff --git a/server/providers/ldap/sdap_async.c b/server/providers/ldap/sdap_async.c
index 1a0faf4..6ab8867 100644
--- a/server/providers/ldap/sdap_async.c
+++ b/server/providers/ldap/sdap_async.c
@@ -578,10 +578,17 @@ static void sdap_connect_done(struct sdap_op *op,
     DEBUG(3, ("START TLS result: %s(%d), %s\n",
               ldap_err2string(state->result), state->result, errmsg));
 
+    if (ldap_tls_inplace(state->sh->ldap)) {
+        DEBUG(9, ("SSL/TLS handler already in place.\n"));
+        tevent_req_done(req);
+        return;
+    }
+
 /* FIXME: take care that ldap_install_tls might block */
     ret = ldap_install_tls(state->sh->ldap);
     if (ret != LDAP_SUCCESS) {
-        DEBUG(1, ("ldap_install_tls failed.\n"));
+        DEBUG(1, ("ldap_install_tls failed: [%d][%s]\n", ret,
+                  ldap_err2string(ret)));
         state->result = ret;
         tevent_req_error(req, EIO);
         return;
-- 
1.6.2.5



More information about the sssd-devel mailing list