[SSSD] Configuring a native LDAP domain: example config

David O'Brien davido at redhat.com
Fri May 28 13:22:50 UTC 2010


Jakub Hrozek wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 05/28/2010 04:35 AM, David O'Brien wrote:
>> I'd like to get my example config (below) in sync with latest 
>> recommendations and what the man page has to say. In the process we 
>> might even find some things that need review or update.
>>
>> 1. I've already changed enumerate to false
> 
> Sorry to nitpick, but maybe we should be consistent about using TRUE vs.
> true and false vs. FALSE in the examples.

I asked the same question in IRC a little while back but no-one replied 
- I think it was the wrong time of day  :-)  I think somebody else 
raised the question of using zero and non-zero for FALSE and TRUE. I 
agree, we should choose a style and stick to it. I vote for TRUE/FALSE

> 
>> 2. I'm curious about tls_reqcert: I know there are several options 
>> (never, allow, try, etc.), but wonder if in this particular config 
>> demand (hard) is required due to the encrypted channel requirements of 
>> authentication against an LDAP server. Educate me?
> 
> Setting tls_reqcert to hard is not required for authentication. We only
> require that the ldap authentication must be done over a secure channel.
> 
> When setting up this encrypted channel, the server may be asked to
> present itself with its certificate, the client can then checks the
> certificate to verify the authenticity of the server. The
> ldap_tls_reqcert option specifies whether to request the server
> certificate and what checks to perform.

ok, wires crossed there. tls_reqcert is for checking the validity of the 
server, nothing to do with setting up the encrypted channel.
> 
>> 3. ldap_tls_cacert value: the man page says the default is use OpenLDAP 
>> defaults, typically in /etc/openldap/ldap.conf. Should I update my 
>> example with the default value?
>>
> 
> I personally don't have a strong preference.. The current example points
> to Mozilla CA cert bundle which might be OK for deployments that have
> commercial certificates from companies like VeriSign. Not sure how
> representative this example is in real world..but I suspect many
> deployments will just use their own internal CA or even self-signed
> certificates.
> 
I might update this to something like </path/to/preferred/certificate> 
or something similar.

>> Again, any suggestions on a better example very welcome.
>>
> 
> I wonder if the example config should list "ldap_search_base" instead of
> "ldap_user_search_base". If we are going to include
> ldap_user_search_base, I think we should also include
> ldap_group_search_base.

I wondered about that too, especially given that ldap_user_search_base 
uses the value of ldap_search_base as its default. How about I just list 
"ldap_search_base" instead of "ldap_user_search_base" (same value)?

Thanks for your help.
-- 

David O'Brien
Senior Technical Writer, Engineering Content Services
Red Hat Asia Pacific Pty Ltd
193 North Quay, Brisbane

"We couldn't care less about comfort. We make you feel good."
Federico Minoli CEO Ducati Motor S.p.A.



More information about the sssd-devel mailing list