[SSSD] LDAP connection tracking, sharing and fail-over retry framework

Simo Sorce ssorce at redhat.com
Fri Jun 18 14:03:18 UTC 2010


On Fri, 18 Jun 2010 16:18:05 +0400
Eugene Indenbom <eindenbom at gmail.com> wrote:

> I hope that 389-ds team would support dropping expired GSSAPI
> connection BEFORE changes to MIT Kerberos implementation become
> widely available. Otherwise it will create a substantial hole in DS
> security.

There is really no hole, it would be identical to password
authentication over a SSL channel.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-devel mailing list