[SSSD] Configuring a native LDAP domain: example config

Jakub Hrozek jhrozek at redhat.com
Fri May 28 12:30:34 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/28/2010 04:35 AM, David O'Brien wrote:
> I'd like to get my example config (below) in sync with latest 
> recommendations and what the man page has to say. In the process we 
> might even find some things that need review or update.
> 
> 1. I've already changed enumerate to false

Sorry to nitpick, but maybe we should be consistent about using TRUE vs.
true and false vs. FALSE in the examples.

> 2. I'm curious about tls_reqcert: I know there are several options 
> (never, allow, try, etc.), but wonder if in this particular config 
> demand (hard) is required due to the encrypted channel requirements of 
> authentication against an LDAP server. Educate me?

Setting tls_reqcert to hard is not required for authentication. We only
require that the ldap authentication must be done over a secure channel.

When setting up this encrypted channel, the server may be asked to
present itself with its certificate, the client can then checks the
certificate to verify the authenticity of the server. The
ldap_tls_reqcert option specifies whether to request the server
certificate and what checks to perform.

> 3. ldap_tls_cacert value: the man page says the default is use OpenLDAP 
> defaults, typically in /etc/openldap/ldap.conf. Should I update my 
> example with the default value?
> 

I personally don't have a strong preference.. The current example points
to Mozilla CA cert bundle which might be OK for deployments that have
commercial certificates from companies like VeriSign. Not sure how
representative this example is in real world..but I suspect many
deployments will just use their own internal CA or even self-signed
certificates.

> Again, any suggestions on a better example very welcome.
> 

I wonder if the example config should list "ldap_search_base" instead of
"ldap_user_search_base". If we are going to include
ldap_user_search_base, I think we should also include
ldap_group_search_base.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkv/t2oACgkQHsardTLnvCWAMQCbBNsnSyVdm54KP4WwYslyjmY/
JpEAn12bKLw6b1729JNY++J9uLyCtK8h
=9oyo
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list